VMCloak: Toward a stealthy in-VM agent execution

Chiawei Wang, Shiuhpyng Shieh

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

In-VM agent programs are generally used for the convenience of VM monitor in malware analysis. To prevent malicious interference, the stealthy execution of an in-VM agent is desirable. Existing approaches for stealthy execution of the agent remains detectable if libraries or kernel code of the guest OS is contaminated by malware. Moreover, the lack of applicability to conventional executables limits the agent functionality. In this paper, VMCloak is proposed for the stealthy in-VM agent execution. Our scheme leverages the virtualization technology to perform the real-time binary instrumentation to conceal the fingerprints of an in-VM agent from potential detection. Both stealthiness and integrity of the agent are guaranteed even when the guest OS is compromised. The evaluation shows that VMCloak can cope with the applicability issues, allowing the in-VM agent to perform the same operations as that of ordinary executables.

Original languageEnglish
Title of host publication2017 IEEE Conference on Dependable and Secure Computing
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages115-122
Number of pages8
ISBN (Electronic)9781509055692
DOIs
StatePublished - 18 Oct 2017
Event2017 IEEE Conference on Dependable and Secure Computing - Taipei, Taiwan
Duration: 7 Aug 201710 Aug 2017

Publication series

Name2017 IEEE Conference on Dependable and Secure Computing

Conference

Conference2017 IEEE Conference on Dependable and Secure Computing
Country/TerritoryTaiwan
CityTaipei
Period7/08/1710/08/17

Keywords

  • Malware
  • Software security
  • Virtual machine

Fingerprint

Dive into the research topics of 'VMCloak: Toward a stealthy in-VM agent execution'. Together they form a unique fingerprint.

Cite this