Combining Virtual Machine Introspection with Network-Based Intrusion Detection Systems

Visa enkel post
dc.contributor.authorGustafsson, Julia
dc.contributor.authorDaftari, Mahboobeh
dc.contributor.departmentChalmers tekniska högskola / Institutionen för data- och informationsteknik (Chalmers)sv
dc.contributor.departmentChalmers University of Technology / Department of Computer Science and Engineering (Chalmers)en
dc.date.accessioned2019-07-03T14:23:40Z
dc.date.available2019-07-03T14:23:40Z
dc.date.issued2016
dc.description.abstractAn increasing number of systems are running as guest systems in virtual machines, for example, applications are moving to be running in the cloud. As the number of cyber attacks is rising, there is a need for a more secure environment. Virtual machines have the advantage that it is possible to inspect the content of the guest systems, called virtual machine introspection. This thesis aims to investigate a new way of securing systems - by combining virtual machine introspection and networkbased intrusion detection systems. Network-based intrusion detection system can inspect the content of the network packets going to all the systems in a network in real-time, they quickly can detect potential attacks. However, network-based intrusion detection systems have problems with false-positive alarms and to discover zero-day exploits. However, by combing virtual machine introspection with a network-based intrusion detection system the data from the virtual machine introspection could be used to provide more information about potential attacks and improve the network-based intrusion detection system at the same time. The goal of this thesis is to investigate how virtual machine introspection could be combined with network-based intrusion detection systems to produce a more secure system. By selecting an application and attacks to test, test cases were performed and data could be gathered from the two systems. The result showed that several of the attacks was fully detectable by virtual machine introspection. However, the data gathered from the network-based intrusions detection system showed that even if the network-based intrusion detection system could, in this case, detect the chosen attacks, it could not provide any details about the result of the attack. Hence, virtual machine introspection is a great extension to the network-based intrusion detection system. However, a performance analysis of the virtual machine introspection platform was performed, which showed the it has several performance issues. Due to the performance of the platform, we recommend that a combined system should only be used during certain circumstances, such as when the network-based intrusions detection system raises an alert.
dc.identifier.urihttps://hdl.handle.net/20.500.12380/245361
dc.language.isoeng
dc.setspec.uppsokTechnology
dc.subjectInformations- och kommunikationsteknik
dc.subjectData- och informationsvetenskap
dc.subjectInformation & Communication Technology
dc.subjectComputer and Information Science
dc.titleCombining Virtual Machine Introspection with Network-Based Intrusion Detection Systems
dc.type.degreeExamensarbete för masterexamensv
dc.type.degreeMaster Thesisen
dc.type.uppsokH
local.programmeComputer systems and networks (MPCSN), MSc
Ladda ner
Original bundle
Visar 1 - 1 av 1
Bild (thumbnail)
Namn:
245361.pdf
Storlek:
4.1 MB
Format:
Adobe Portable Document Format
Beskrivning:
Fulltext
Ladda ner
Samling
Examensarbeten för masterexamen