• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文学位 >Improving host-based computer security using secure active monitoring and memory analysis.
【24h】

Improving host-based computer security using secure active monitoring and memory analysis.

机译：使用安全的主动监视和内存分析来提高基于主机的计算机安全性。

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Thirty years ago, research in designing operating systems to defeat malicious software was very popular. The primary technique was to design and implement a small security kernel that could provide security assurances to the rest of the system. However, as operating systems grew in size throughout the 1980's and 1990's, research into security kernels slowly waned. From a security perspective, the story was bleak. Providing security to one of these large operating systems typically required running software within that operating system. This weak security foundation made it relatively easy for attackers to subvert the entire system without detection.;The research presented in this thesis aims to reimagine how we design and deploy computer systems. We show that through careful use of virtualization technology, one can effectively isolate the security critical components in a system from malicious software. Furthermore, we can control this isolation to allow the security software a complete view to monitor the running system. This view includes all of the necessary information for implementing useful security applications including the system memory, storage, hardware events, and network traffic. In addition, we show how to perform both passive and active monitoring securely, using this new system architecture.;Security applications must be redesigned to work within this new monitoring architecture. The data acquired through our monitoring is typically very low-level and difficult to use directly. In this thesis, we describe work that helps bridge this semantic gap by locating data structures within the memory of a running virtual machine. We also describe work that shows a useful and novel security framework made possible through this new monitoring architecture. This framework correlates human interaction with the system to distinguish legitimate and malicious outgoing network traffic.
机译：三十年前，关于设计操作系统以击败恶意软件的研究非常流行。主要技术是设计和实现一个小型安全内核，该内核可以为系统的其余部分提供安全保证。但是，随着整个1980年代和1990年代操作系统规模的扩大，对安全内核的研究逐渐减弱。从安全角度来看，这个故事是暗淡的。为这些大型操作系统之一提供安全性通常需要在该操作系统内运行软件。这种薄弱的安全基础使攻击者相对容易地破坏整个系统而不进行检测。;本文提出的研究旨在重新想象我们如何设计和部署计算机系统。我们表明，通过认真使用虚拟化技术，可以有效地将系统中安全性至关重要的组件与恶意软件隔离开。此外，我们可以控制这种隔离，以使安全软件有完整的视图来监视正在运行的系统。该视图包括用于实现有用的安全应用程序的所有必要信息，包括系统内存，存储，硬件事件和网络流量。此外，我们还展示了如何使用这种新的系统架构安全地执行被动和主动监视。;必须重新设计安全性应用程序才能在这种新的监视架构内工作。通过我们的监视获取的数据通常非常低级，难以直接使用。在本文中，我们描述了通过在正在运行的虚拟机内存中定位数据结构来帮助弥合这种语义鸿沟的工作。我们还将描述通过这种新的监视体系结构实现的有用且新颖的安全框架的工作。该框架将人与系统的交互关联起来，以区分合法和恶意的传出网络流量。

著录项

  • 作者

    Payne, Bryan D.;

  • 作者单位

    Georgia Institute of Technology.;

  • 授予单位 Georgia Institute of Technology.;
  • 学科 Computer Science.
  • 学位 Ph.D.
  • 年度 2010
  • 页码 184 p.
  • 总页数 184
  • 原文格式 PDF
  • 正文语种 eng
  • 中图分类
  • 关键词

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号