$^+$ , a multi-aspect, memory exclusive approach for precise and robust guest OS fingerprinting in the cloud. It works as follows: given a physical memory dump of a guest OS, OS-Sommelier$^+$ first uses a code hash based approach from kernel code aspect to determine the guest OS version. If code hash approach fails, OS-Sommelier$^+$ then uses a kernel data signature based approach from kernel data aspect to determine the version. We have implemented a prototype system, and tested it with a number of Linux kernels. Our evaluation results show that the code hash approach is faster but can only fingerprint the known kernels, and data signature approach complements the code signature approach and can fingerprint even unknown kernels." /> $^+$ , a multi-aspect, memory exclusive approach for precise and robust guest OS fingerprinting in the cloud. It works as follows: given a physical memory dump of a guest OS, OS-Sommelier$^+$ first uses a code hash based approach from kernel code aspect to determine the guest OS version. If code hash approach fails, OS-Sommelier$^+$ then uses a kernel data signature based approach from kernel data aspect to determine the version. We have implemented a prototype system, and tested it with a number of Linux kernels. Our evaluation results show that the code hash approach is faster but can only fingerprint the known kernels, and data signature approach complements the code signature approach and can fingerprint even unknown kernels." /> $^+$ , a multi-aspect, memory exclusive approach for precise and robust guest OS fingerprinting in the cloud. It works as follows: given a physical memory dump of a guest OS, OS-Sommelier$^+$ first uses a code hash based approach from kernel code aspect to determine the guest OS version. If code hash approach fails, OS-Sommelier$^+$ then uses a kernel data signature based approach from kernel data aspect to determine the version. We have implemented a prototype system, and tested it with a number of Linux kernels. Our evaluation results show that the code hash approach is faster but can only fingerprint the known kernels, and data signature approach complements the code signature approach and can fingerprint even unknown kernels." /> Multi-Aspect, Robust, and MemoryExclusive Guest OS Fingerprinting
The Community for Technology Leaders
RSS Icon
Subscribe
Issue No.04 - Oct.-Dec. (2014 vol.2)
pp: 380-394
Yufei Gu , Department of Computer Science, The University of Texas at Dallas, 800 W. Campbell RD, Richardson, TX
Yangchun Fu , Department of Computer Science, The University of Texas at Dallas, 800 W. Campbell RD, Richardson, TX
Aravind Prakash , Department of Computer Science Syracuse University, 400 Ostrom Avenue, Syracuse, NY
Zhiqiang Lin , Department of Computer Science, The University of Texas at Dallas, 800 W. Campbell RD, Richardson, TX
Heng Yin , Department of Computer Science Syracuse University, 400 Ostrom Avenue, Syracuse, NY
ABSTRACT
Precise fingerprinting of an operating system (OS) is critical to many security and forensics applications in the cloud, such as virtual machine (VM) introspection, penetration testing, guest OS administration, kernel dump analysis, and memory forensics. The existing OS fingerprinting techniques primarily inspect network packets or CPU states, and they all fall short in precision and usability. As the physical memory of a VM always exists in all these applications, in this article, we present OS-Sommelier$^+$ , a multi-aspect, memory exclusive approach for precise and robust guest OS fingerprinting in the cloud. It works as follows: given a physical memory dump of a guest OS, OS-Sommelier$^+$ first uses a code hash based approach from kernel code aspect to determine the guest OS version. If code hash approach fails, OS-Sommelier$^+$ then uses a kernel data signature based approach from kernel data aspect to determine the version. We have implemented a prototype system, and tested it with a number of Linux kernels. Our evaluation results show that the code hash approach is faster but can only fingerprint the known kernels, and data signature approach complements the code signature approach and can fingerprint even unknown kernels.
INDEX TERMS
Kernel, Robustness, Data structures, Cloud computing, Forensics, Linux, Virtual machining,memory forensics, Operating system fingerprinting, virtual machine introspection
CITATION
Yufei Gu, Yangchun Fu, Aravind Prakash, Zhiqiang Lin, Heng Yin, "Multi-Aspect, Robust, and MemoryExclusive Guest OS Fingerprinting", IEEE Transactions on Cloud Computing, vol.2, no. 4, pp. 380-394, Oct.-Dec. 2014, doi:10.1109/TCC.2014.2338305
73 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool