LiveCloudInspector: Towards Integrated IaaS Forensics in the Cloud
Cloud-based systems are becoming an increasingly attractive target for malicious attacks. In IaaS environments, malicious attacks on a cloud customer’s virtual machine may affect the customer, who cannot use all diagnostic means that are available in dedicated in-house infrastructures, as well as the cloud provider, due to possible subsequent attacks against the cloud infrastructure and other co-hosted customers. This paper presents an integrated approach towards forensics and incident analysis in IaaS cloud environments. The proposed architecture enables the cloud provider to securely offer forensics services to its customers on a self-service platform. The architecture combines three important analysis techniques and provides significantly better investigation capabilities than existing systems: First, it supports host-based forensics based on virtual machine introspection. Second, it offers live remote capture of network traffic. Third, and most importantly, it provides hybrid combinations of the first two techniques, which enables enhanced analysis capabilities such as support for monitoring encrypted communication.
KeywordsCloud Computing Virtual Machine Main Memory Cloud Provider Cloud User
- 1.Bahram, S., Jiang, X., Wang, Z., Grace, M., Li, J., Srinivasan, D., Rhee, J., Xu, D.: DKSM: Subverting virtual machine introspection for fun and profit. In: 29th IEEE Symposium on Reliable Distributed Systems (SRDS), pp. 82–91 (October 2010)Google Scholar
- 2.Birk, D., Wegener, C.: Technical issues of forensic investigations in cloud computing environments. In: Proceedings of the 2011 Sixth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2011, pp. 1–10. IEEE Computer Society, Washington, DC (2011)CrossRefGoogle Scholar
- 5.Garfinkel, S.: Network forensics: Tapping the internet, http://www.oreillynet.com/pub/a/network/2002/04/26/nettap.html (April 01, 2015)
- 8.Paleari, R., Martignoni, L., Roglia, G.F., Bruschi, D.: A fistful of red-pills: How to automatically generate procedures to detect cpu emulators. In: Proceedings of the 3rd USENIX Conference on Offensive Technologies, WOOT 2009. USENIX Association, Berkeley (2009)Google Scholar