University of Illinois Urbana-Champaign

An architecture for trustworthy services built on event based probing of untrusted guests

Sprabery, Read T

Content Files
SPRABERY-THESIS-2016.pdf

Permalink

https://hdl.handle.net/2142/92849

Description

Title
An architecture for trustworthy services built on event based probing of untrusted guests
Author(s)
Sprabery, Read T
Issue Date
2016-07-18
Director of Research (if dissertation) or Advisor (if thesis)
  • Campbell, Roy
  • Bobba, Rakesh
Department of Study
Computer Science
Discipline
Computer Science
Degree Granting Institution
University of Illinois at Urbana-Champaign
Degree Name
M.S.
Degree Level
Thesis
Date of Ingest
2016-11-10T17:55:13Z
Keyword(s)
  • Intrusion Detection
  • Hypervisor
  • Trustworthy Logging
Abstract
Numerous event-based probing methods exist for cloud computing environments allowing a trusted hypervisor to gain insight into guest activities. Such event based probing has been shown to be useful for detecting attacks, system hangs through watchdogs, and also for inserting exploit detectors before a system can be patched, among others. In this paper, we illustrate how to use such probing for trustworthy logging and highlight some of the challenges that existing event based probing mechanisms do not address. These challenges include ensuring a probe inserted at given address is trustworthy despite the lack of attestation available for probes that have been inserted dynamically. We show how probes can be inserted to ensure proper logging of every invocation of a probed instruction. When combined with attested boot of the hypervisor and guest machines, we can ensure the output stream of monitored events is trustworthy. Using these techniques we build a trustworthy log of certain guest-system-call events powering a cloud-tuned Intrusion Detection System (IDS). Additionally, we identify new types of events that must be added to existing probing systems to ensure attempts to circumvent probes within the guest appear in the log. We highlight the overhead penalties paid by guests to ensure log completeness when faced with probabilistic attacks and show promising results (less that 10% for guests) when a guest is willing to relax the trade-off between log completeness and overhead. Our demonstrative IDS shows the ability to detect common attack scenarios with simple policies built using our guest behavior recording system.
Graduation Semester
2016-08
Type of Resource
text
Permalink
http://hdl.handle.net/2142/92849
Copyright and License Information
Copyright 2016 Read Sprabery

Owning Collections

Graduate Dissertations and Theses at Illinois PRIMARY
Graduate Theses and Dissertations at Illinois