Live and Trustworthy Forensic Analysis of Commodity Production Systems

  • Lorenzo Martignoni
  • Aristide Fattori
  • Roberto Paleari
  • Lorenzo Cavallaro
Conference paper

DOI: 10.1007/978-3-642-15512-3_16

Part of the Lecture Notes in Computer Science book series (LNCS, volume 6307)
Cite this paper as:
Martignoni L., Fattori A., Paleari R., Cavallaro L. (2010) Live and Trustworthy Forensic Analysis of Commodity Production Systems. In: Jha S., Sommer R., Kreibich C. (eds) Recent Advances in Intrusion Detection. RAID 2010. Lecture Notes in Computer Science, vol 6307. Springer, Berlin, Heidelberg

Abstract

We present HyperSleuth, a framework that leverages the virtualization extensions provided by commodity hardware to securely perform live forensic analysis of potentially compromised production systems. HyperSleuth provides a trusted execution environment that guarantees four fundamental properties. First, an attacker controlling the system cannot interfere with the analysis and cannot tamper the results. Second, the framework can be installed as the system runs, without a reboot and without loosing any volatile data. Third, the analysis performed is completely transparent to the OS and to an attacker. Finally, the analysis can be periodically and safely interrupted to resume normal execution of the system. On top of HyperSleuth we implemented three forensic analysis applications: a lazy physical memory dumper, a lie detector, and a system call tracer. The experimental evaluation we conducted demonstrated that even time consuming analysis, such as the dump of the content of the physical memory, can be securely performed without interrupting the services offered by the system.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2010

Authors and Affiliations

  • Lorenzo Martignoni
    • 1
  • Aristide Fattori
    • 2
  • Roberto Paleari
    • 2
  • Lorenzo Cavallaro
    • 3
  1. 1.Università degli Studi di UdineItaly
  2. 2.Università degli Studi di MilanoItaly
  3. 3.Vrije Universiteit AmsterdamThe Netherlands

Personalised recommendations