{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,15]],"date-time":"2026-10-15T16:37:42Z","timestamp":1792082262682,"version":"4.4.0"},"reference-count":49,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2011,7,18]],"date-time":"2011-07-18T00:00:00Z","timestamp":1310947200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGOPS Oper. Syst. Rev."],"published-print":{"date-parts":[[2011,7,18]]},"abstract":"<jats:p>As virtualization technology gains in popularity, so do attempts to compromise the security and integrity of virtualized computing resources. Anti-virus software and firewall programs are typically deployed in the guest virtual machine to detect malicious software. These security measures are effective in detecting known malware, but do little to protect against new variants of intrusions. Intrusion detection systems (IDSs) can be used to detect malicious behavior. Most intrusion detection systems for virtual execution environments track behavior at the application or operating system level, using virtualization as a means to isolate themselves from a compromised virtual machine.<\/jats:p>\n          <jats:p>In this paper, we present a novel approach to intrusion detection of virtual server environments which utilizes only information available from the perspective of the virtual machine monitor (VMM). Such an IDS can harness the ability of the VMM to isolate and manage several virtual machines (VMs), making it possible to provide monitoring of intrusions at a common level across VMs. It also offers unique advantages over recent advances in intrusion detection for virtual machine environments. By working purely at the VMM-level, the IDS does not depend on structures or abstractions visible to the OS (e.g., file systems), which are susceptible to attacks and can be modified by malware to contain corrupted information (e.g., the Windows registry). In addition, being situated within the VMM provides ease of deployment as the IDS is not tied to a specific OS and can be deployed transparently below different operating systems.<\/jats:p>\n          <jats:p>Due to the semantic gap between the information available to the VMM and the actual application behavior, we employ the power of data mining techniques to extract useful nuggets of knowledge from the raw, low-level architectural data. We show in this paper that by working entirely at the VMM-level, we are able to capture enough information to characterize normal executions and identify the presence of abnormal malicious behavior. Our experiments on over 300 real-world malware and exploits illustrate that there is sufficient information embedded within the VMM-level data to allow accurate detection of malicious attacks, with an acceptable false alarm rate.<\/jats:p>","DOI":"10.1145\/2007183.2007189","type":"journal-article","created":{"date-parts":[[2011,7,21]],"date-time":"2011-07-21T13:27:09Z","timestamp":1311254829000},"page":"38-53","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":60,"title":["Virtual machine monitor-based lightweight intrusion detection"],"prefix":"10.1145","volume":"45","author":[{"given":"Fatemeh","family":"Azmandian","sequence":"first","affiliation":[{"name":"Northeastern University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Micha","family":"Moffie","sequence":"additional","affiliation":[{"name":"Northeastern University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Malak","family":"Alshawabkeh","sequence":"additional","affiliation":[{"name":"Northeastern University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jennifer","family":"Dy","sequence":"additional","affiliation":[{"name":"Northeastern University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Javed","family":"Aslam","sequence":"additional","affiliation":[{"name":"Northeastern University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Kaeli","sequence":"additional","affiliation":[{"name":"Northeastern University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2011,7,18]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"The SNORT Network IDS. www.snort.org.  The SNORT Network IDS. www.snort.org."},{"key":"e_1_2_1_2_1","unstructured":"The Apache Software Foundation. ab - Apache HTTP server benchmarking tool. http:\/\/www.apache.org\/.  The Apache Software Foundation. ab - Apache HTTP server benchmarking tool. http:\/\/www.apache.org\/."},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/945445.945462"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/335191.335388"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.5555\/874075.876409"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2008.4575125"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/360051.360056"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455779"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2005.10.010"},{"key":"e_1_2_1_10_1","first-page":"103","volume-title":"Proceedings of the 13th USENIX Security Symposium","author":"Gao D.","year":"2004","unstructured":"D. Gao , M. K. Reiter , and D. Song . On gray-box program tracking for anomaly detection . In Proceedings of the 13th USENIX Security Symposium , pages 103 -- 118 , San Diego, CA, USA , Aug. 9-13 2004 . D. Gao, M. K. Reiter, and D. Song. On gray-box program tracking for anomaly detection. In Proceedings of the 13th USENIX Security Symposium, pages 103--118, San Diego, CA, USA, Aug. 9-13 2004."},{"key":"e_1_2_1_11_1","volume-title":"Proc. Network and Distributed Systems Security Symposium","author":"Garfinkel T.","year":"2003","unstructured":"T. Garfinkel and M. Rosenblum . A virtual machine introspection based architecture for intrusion detection . In Proc. Network and Distributed Systems Security Symposium , February 2003 . T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Proc. Network and Distributed Systems Security Symposium, February 2003."},{"key":"e_1_2_1_13_1","volume-title":"Proceedings of the 17th USENIX Security Symposium (Security'08)","author":"Gu G.","year":"2008","unstructured":"G. Gu , R. Perdisci , J. Zhang , and W. Lee . BotMiner: Clustering analysis of network traffic for protocol- and structure-independent botnet detection . In Proceedings of the 17th USENIX Security Symposium (Security'08) , 2008 . G. Gu, R. Perdisci, J. Zhang, and W. Lee. BotMiner: Clustering analysis of network traffic for protocol- and structure-independent botnet detection. In Proceedings of the 17th USENIX Security Symposium (Security'08), 2008."},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-980109"},{"key":"e_1_2_1_15_1","unstructured":"Innotek. Innotek virtualbox. http:\/\/www.virtualbox.org\/.  Innotek. Innotek virtualbox. http:\/\/www.virtualbox.org\/."},{"key":"e_1_2_1_16_1","unstructured":"ISC OARC. Project Malfease. https:\/\/malfease.oarci.net\/.  ISC OARC. Project Malfease. https:\/\/malfease.oarci.net\/."},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1002\/scj.v35:6"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315262"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1516241.1516310"},{"key":"e_1_2_1_20_1","volume-title":"ATEC '06: Proceedings of the annual conference on USENIX '06 Annual Technical Conference","author":"Jones S. T.","year":"2006","unstructured":"S. T. Jones , A. C. Arpaci-Dusseau , and R. H. Arpaci-Dusseau . Antfarm: tracking processes in a virtual machine environment . In ATEC '06: Proceedings of the annual conference on USENIX '06 Annual Technical Conference , Berkeley, CA, USA , 2006 . USENIX Association. S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau. Antfarm: tracking processes in a virtual machine environment. In ATEC '06: Proceedings of the annual conference on USENIX '06 Annual Technical Conference, Berkeley, CA, USA, 2006. USENIX Association."},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1346256.1346269"},{"key":"e_1_2_1_22_1","volume-title":"Proceedings of the 15th USENIX Security Symposium","author":"Kirda E.","year":"2006","unstructured":"E. Kirda , C. Kruegel , G. Banks , G. Vigna , and R. Kemmerer . Behavior-based Spyware Detection . In Proceedings of the 15th USENIX Security Symposium , Vancouver, BC, Canada , Aug. 2006 . E. Kirda, C. Kruegel, G. Banks, G. Vigna, and R. Kemmerer. Behavior-based Spyware Detection. In Proceedings of the 15th USENIX Security Symposium, Vancouver, BC, Canada, Aug. 2006."},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/52.605929"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2006.09.007"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611972733.3"},{"key":"e_1_2_1_26_1","first-page":"50","volume-title":"In AAAI Workshop on AI Approaches to Fraud Detection and Risk Management","author":"Lee W.","year":"1997","unstructured":"W. Lee , S. J. Stolfo , and P. K. Chan . Learning patterns from unix process execution traces for intrusion detection . In In AAAI Workshop on AI Approaches to Fraud Detection and Risk Management , pages 50 -- 56 . AAAI Press , 1997 . W. Lee, S. J. Stolfo, and P. K. Chan. Learning patterns from unix process execution traces for intrusion detection. In In AAAI Workshop on AI Approaches to Fraud Detection and Risk Management, pages 50--56. AAAI Press, 1997."},{"key":"e_1_2_1_27_1","first-page":"120","volume-title":"In IEEE Symposium on Security and Privacy","author":"Lee W.","year":"1999","unstructured":"W. Lee , S. J. Stolfo , and K. W. Mok . A data mining framework for building intrusion detection models . In In IEEE Symposium on Security and Privacy , pages 120 -- 132 , 1999 . W. Lee, S. J. Stolfo, and K. W. Mok. A data mining framework for building intrusion detection models. In In IEEE Symposium on Security and Privacy, pages 120--132, 1999."},{"key":"e_1_2_1_28_1","volume-title":"Use of k-nearest neighbor classifier for intrusion detection","author":"Liao Y.","year":"2002","unstructured":"Y. Liao and V. R. Vemuri . Use of k-nearest neighbor classifier for intrusion detection , 2002 . Y. Liao and V. R. Vemuri. Use of k-nearest neighbor classifier for intrusion detection, 2002."},{"key":"e_1_2_1_29_1","volume-title":"Concepts, applications, and performance modeling","author":"Menasc\u00e9 D. A.","year":"2005","unstructured":"D. A. Menasc\u00e9 . Virtualization : Concepts, applications, and performance modeling , 2005 . D. A. Menasc\u00e9. Virtualization: Concepts, applications, and performance modeling, 2005."},{"key":"e_1_2_1_30_1","unstructured":"Microsoft. Microsoft Exchange Server 2003 Load Simulator (LoadSim). http:\/\/www.microsoft.com\/.  Microsoft. Microsoft Exchange Server 2003 Load Simulator (LoadSim). http:\/\/www.microsoft.com\/."},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/292540.292561"},{"key":"e_1_2_1_32_1","unstructured":"NEI. Network Engines. http:\/\/www.nei.com\/.  NEI. Network Engines. http:\/\/www.nei.com\/."},{"key":"e_1_2_1_33_1","volume-title":"The 12th Annual Network and Distributed System Security Symposium, Feb. 3-4","author":"Newsome J.","year":"2005","unstructured":"J. Newsome and D. Song . Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software . In The 12th Annual Network and Distributed System Security Symposium, Feb. 3-4 , San Diego, CA, USA , 2005 . J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In The 12th Annual Network and Distributed System Security Symposium, Feb. 3-4, San Diego, CA, USA, 2005."},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2005.06.003"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/CIDM.2007.368917"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR.1994.576920"},{"key":"e_1_2_1_37_1","volume-title":"Linux iptables - kurz & gut. O'Reilly, 08","author":"Purdy G. N.","year":"2004","unstructured":"G. N. Purdy . Linux iptables - kurz & gut. O'Reilly, 08 2004 . G. N. Purdy. Linux iptables - kurz & gut. O'Reilly, 08 2004."},{"key":"e_1_2_1_38_1","first-page":"55","volume-title":"HOTOS '03: Proceedings of the 9th conference on Hot Topics in Operating Systems","author":"Sapuntzakis C.","year":"2003","unstructured":"C. Sapuntzakis and M. S. Lam . Virtual appliances in the collective: A road to hassle-free computing . In HOTOS '03: Proceedings of the 9th conference on Hot Topics in Operating Systems , pages 55 -- 60 , Berkeley, CA, USA , May 2003 . USENIX Association. C. Sapuntzakis and M. S. Lam. Virtual appliances in the collective: A road to hassle-free computing. In HOTOS '03: Proceedings of the 9th conference on Hot Topics in Operating Systems, pages 55--60, Berkeley, CA, USA, May 2003. USENIX Association."},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.5555\/882495.884439"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.5555\/784592.784801"},{"key":"e_1_2_1_41_1","first-page":"17","volume-title":"USENIX 2005 Annual Technical Conference","author":"Seward J.","year":"2005","unstructured":"J. Seward and N. Nethercote . Using valgrind to detect undefined value errors with bit-precision . In USENIX 2005 Annual Technical Conference , pages 17 -- 30 , Apr. 10-15, Anaheim, CA, USA , 2005 . J. Seward and N. Nethercote. Using valgrind to detect undefined value errors with bit-precision. In USENIX 2005 Annual Technical Conference, pages 17--30, Apr. 10-15, Anaheim, CA, USA, 2005."},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.5555\/1239367.1239370"},{"key":"e_1_2_1_43_1","unstructured":"Transaction Processing Performance Council (TPC). TPC-C an on-line transaction processing benchmark. http:\/\/www.tpc.org\/.  Transaction Processing Performance Council (TPC). TPC-C an on-line transaction processing benchmark. http:\/\/www.tpc.org\/."},{"key":"e_1_2_1_44_1","unstructured":"UML. User-mode linux kernel. http:\/\/user-mode-linux.sourceforge.net\/.  UML. User-mode linux kernel. http:\/\/user-mode-linux.sourceforge.net\/."},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2004.31"},{"key":"e_1_2_1_46_1","unstructured":"VMware. VMware. http:\/\/www.vmware.com\/.  VMware. VMware. http:\/\/www.vmware.com\/."},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.5555\/882495.884434"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/CIT.2008.Workshops.102"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1999.766910"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/WKDD.2008.135"}],"container-title":["ACM SIGOPS Operating Systems Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2007183.2007189","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2007183.2007189","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T10:59:58Z","timestamp":1750244398000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2007183.2007189"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011,7,18]]},"references-count":49,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2011,7,18]]}},"alternative-id":["10.1145\/2007183.2007189"],"URL":"https:\/\/doi.org\/10.1145\/2007183.2007189","relation":{},"ISSN":["0163-5980"],"issn-type":[{"value":"0163-5980","type":"print"}],"subject":[],"published":{"date-parts":[[2011,7,18]]},"assertion":[{"value":"2011-07-18","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}