An XVisor extension using a Domain Specific Language to detect Rootkits in Virtual Machines - UFR ISTIC Informatique et électronique
Pré-Publication, Document De Travail Année : 2025

An XVisor extension using a Domain Specific Language to detect Rootkits in Virtual Machines

Résumé

Endpoint Detection Reaction (EDR) needs to be protected against attackers who manage to gain access to a high privilege level. We propose using virtual extensions for this purpose: the protected system is placed in a VM, and the EDR is implemented in the hypervisor. This ensures that the EDR remains functional even if the VM is fully compromised. However, in such cases, the EDR loses the operating system abstraction provided by the VM. To reduce this semantic gap, we developed a new language that allows a VM to write and send programs to the hypervisor. Since these programs are produced by the VM, we assume they have the necessary knowledge about the internal structure of the VM's operating system. The hypervisor runs these programs to detect intrusions. To secure this process, the hypervisor must enforce strict security constraints to ensure that these programs do not introduce new vulnerabilities. Most tested rootkits could be detected with only an acceptable overhead added to the VM's execution. Furthermore, we demonstrate that this overhead can be further reduced by executing native binaries instead of relying on an interpreter.
Fichier sous embargo
Fichier sous embargo
0 11 28
Année Mois Jours
Avant la publication
samedi 10 janvier 2026
Fichier sous embargo
samedi 10 janvier 2026
Connectez-vous pour demander l'accès au fichier

Dates et versions

hal-04879065 , version 1 (10-01-2025)

Licence

Identifiants

  • HAL Id : hal-04879065 , version 1

Citer

Lionel Hemmerlé, Hiet Guillaume, Tronel Frédéric, Wilke Pierre, Prévotet Jean-Christophe. An XVisor extension using a Domain Specific Language to detect Rootkits in Virtual Machines. 2025. ⟨hal-04879065⟩
0 Consultations
0 Téléchargements

Partager

More