Proteção de detectores de intrusão através de máquinas virtuais
Resumo
Os sistemas de detecção de intrusão monitoram continuamente a atividade de um sistema ou rede, buscando evidências de intrusões. Entretanto, detectores de intrusão baseados em host podem ser adulterados ou desativados por invasores bem sucedidos. Este trabalho apresenta uma arquitetura que visa proteger detectores de intrusão baseados em host através de máquinas virtuais. A proposta aqui apresentada usa o isolamento de espaços de execução provido por um ambiente de máquinas virtuais para separar o detector de intrusão do sistema a monitorar. Em conseqüência, o detector de intrusão torna-se invisível e inacessível a eventuais intrusos. Os testes realizados mostram a viabilidade dessa solução.
Palavras-chave:
detecção de intrusão, máquinas virtuais, segurança, sistemas operacionais de rede
Referências
Allen J., Christie A., Fithen W., McHugh J., Pickel J., Stoner E. State of the Practice of Intrusion Detection Technologies. Technical Report CMU/SEI-99-TR028. Carnegie Mellon University, 1999.
Barham P., Dragovic B., Fraser K., Hand S., Harris T., Ho A., Neugebauer R., Pratt I., Warfield A. Xen and the Art of Virtualization. Proceedings of the ACM Symposium on Operating Systems Principles – SOSP, 2003.
Bernaschi M., Grabrielli E., Mancini L. Operating System Enhancements to Prevent the Misuse of System Calls. Proceedings of the ACM Conference on Computer and Communications Security, 2000.
Bernaschi M., Grabrielli E., Mancini L. REMUS: A Security-Enhanced Operating System. ACM Transactions on Information and System Security. Vol 5, number 1, 2002.
Blunden B. Virtual Machine Design and Implementation in C/C++. Wordware Publ. Plano, Texas – USA, 2002.
Chen P., Noble B. When Virtual is Better than Real. Proceedings of the Workshop on Hot Topics in Operating Systems – HotOS, 2001.
Dike J. A User-mode port of the Linux Kernel. Proceedings of the 4th Annual Linux Showcase & Conference. Atlanta – USA, 2000.
Dunlap G., King S., Cinar S., Basrai M., Chen P. ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay. Proceedings of the Symposium on Operating Systems Design and Implementation – OSDI, 2002.
Embry R. FreeVSD Enables Safe Experimentation. Linux Journal, Issue 87, July 2001.
Forrest S., Hofmeyr S., Somayaji A. A sense of self for Unix processes. Proceedings of the IEEE Symposium on Research in Security and Privacy, 1996.
Garfinkel T., Rosenblum M. A Virtual Machine Introspection Based Architecture for Intrusion Detection. Proceedings of the Network and Distributed System Security Symposium – NDSS, 2003.
Goldberg R. Architecture of Virtual Machines. AFIPS National Computer Conference. New York – NY – USA, 1973.
Hofmeyr S., Forrest S., Somayaji A. Intrusion Detection using Sequences of System Calls. Journal of Computer Security, 6:151–180, 1998.
Kelem N., Feiertag R. A Separation Model for Virtual Machine Monitors. Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy, pages 78-86, 1991.
King S., Chen P. Operating System Extensions to Support Host Based Virtual Machines. Technical Report CSE-TR-465-02, University of Michigan, 2002.
King S., Dunlap G., Chen P. Operating System Support for Virtual Machines, Proceedings of the USENIX Annual Technical Conference, 2003.
Linux VServer Project. http://www.linux-vserver.org, 2004.
Pfitzmann B., Riordan J., Stüble C., Waidner M., Weber A. The PERSEUS System Architecture. Research Report RZ 3335 04/09/01, IBM Research Division, Zurich, April 2001.
Popek G., Goldberg R. Formal Requirements for Virtualizable Third Generation Architectures. Communications of the ACM. Volume 17, number 7, pages 412-421, 1974.
Sugerman J., Ganesh V., Beng-Hong L. Virtualizing I/O Devices on Vmware Workstation’s Hosted Virtual Machine Monitor. Proceedings of the USENIX Annual Technical Conference, 2001.
VMware Inc. VMware Technical White Paper. Palo Alto – CA – USA, 1999.
Whitaker A., Shaw M., Gribble S. Denali: A Scalable Isolation Kernel. Proceedings of the 10th ACM SIGOPS European Workshop, Saint-Emilion – France, 2002.
Barham P., Dragovic B., Fraser K., Hand S., Harris T., Ho A., Neugebauer R., Pratt I., Warfield A. Xen and the Art of Virtualization. Proceedings of the ACM Symposium on Operating Systems Principles – SOSP, 2003.
Bernaschi M., Grabrielli E., Mancini L. Operating System Enhancements to Prevent the Misuse of System Calls. Proceedings of the ACM Conference on Computer and Communications Security, 2000.
Bernaschi M., Grabrielli E., Mancini L. REMUS: A Security-Enhanced Operating System. ACM Transactions on Information and System Security. Vol 5, number 1, 2002.
Blunden B. Virtual Machine Design and Implementation in C/C++. Wordware Publ. Plano, Texas – USA, 2002.
Chen P., Noble B. When Virtual is Better than Real. Proceedings of the Workshop on Hot Topics in Operating Systems – HotOS, 2001.
Dike J. A User-mode port of the Linux Kernel. Proceedings of the 4th Annual Linux Showcase & Conference. Atlanta – USA, 2000.
Dunlap G., King S., Cinar S., Basrai M., Chen P. ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay. Proceedings of the Symposium on Operating Systems Design and Implementation – OSDI, 2002.
Embry R. FreeVSD Enables Safe Experimentation. Linux Journal, Issue 87, July 2001.
Forrest S., Hofmeyr S., Somayaji A. A sense of self for Unix processes. Proceedings of the IEEE Symposium on Research in Security and Privacy, 1996.
Garfinkel T., Rosenblum M. A Virtual Machine Introspection Based Architecture for Intrusion Detection. Proceedings of the Network and Distributed System Security Symposium – NDSS, 2003.
Goldberg R. Architecture of Virtual Machines. AFIPS National Computer Conference. New York – NY – USA, 1973.
Hofmeyr S., Forrest S., Somayaji A. Intrusion Detection using Sequences of System Calls. Journal of Computer Security, 6:151–180, 1998.
Kelem N., Feiertag R. A Separation Model for Virtual Machine Monitors. Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy, pages 78-86, 1991.
King S., Chen P. Operating System Extensions to Support Host Based Virtual Machines. Technical Report CSE-TR-465-02, University of Michigan, 2002.
King S., Dunlap G., Chen P. Operating System Support for Virtual Machines, Proceedings of the USENIX Annual Technical Conference, 2003.
Linux VServer Project. http://www.linux-vserver.org, 2004.
Pfitzmann B., Riordan J., Stüble C., Waidner M., Weber A. The PERSEUS System Architecture. Research Report RZ 3335 04/09/01, IBM Research Division, Zurich, April 2001.
Popek G., Goldberg R. Formal Requirements for Virtualizable Third Generation Architectures. Communications of the ACM. Volume 17, number 7, pages 412-421, 1974.
Sugerman J., Ganesh V., Beng-Hong L. Virtualizing I/O Devices on Vmware Workstation’s Hosted Virtual Machine Monitor. Proceedings of the USENIX Annual Technical Conference, 2001.
VMware Inc. VMware Technical White Paper. Palo Alto – CA – USA, 1999.
Whitaker A., Shaw M., Gribble S. Denali: A Scalable Isolation Kernel. Proceedings of the 10th ACM SIGOPS European Workshop, Saint-Emilion – France, 2002.
Publicado
10/05/2004
Como Citar
LAUREANO, Marcos; MAZIERO, Carlos; JAMHOUR, Edgard.
Proteção de detectores de intrusão através de máquinas virtuais. In: SIMPÓSIO BRASILEIRO DE SEGURANÇA DA INFORMAÇÃO E DE SISTEMAS COMPUTACIONAIS (SBSEG), 4. , 2004, Gramado.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2004
.
p. 153-163.
DOI: https://doi.org/10.5753/sbseg.2004.21234.
