Re: [Xen-users] XenAccess Library: Introspection for Xen

[Mark Williamson <mark.williamson@xxxxxxxxxxxx>]

> The other thing to consider is non-traditional host-based IDS.
> Through introspection, you need not be limited by the presentation of
> information that you normally get inside the operating system.
> Perhaps viewing memory "through a different lens" could lead to some
> interesting new techniques?  Something to think about.

I think it'll enable lots of things - we need to throw away our preconceptions 
to get the best out of the architecture.  So much more is possible without 
the constraints of just running inside / outside machine boundary of the 
monitored system.

> Indeed.  And, in addition to data aggregation, comparing the data
> from in the host to data from introspection to data on the network
> could lead to some interesting analysis.  For example, what if you
> saw conflicting information about the same system from two sensor
> locations?  Perhaps you just detected stealthy malware?

Indeed.  It's going to need a fairly interesting inference engine to figure 
stuff out (and explain its decisions to administrators afterwards!).  Could 
be quite a cool project, depending on how much groundwork for this sort of 
thing already exists.

> I'm excited about the possibilities.  Within the XenAccess project,
> I'm looking forward to collecting more data (including the driver
> taps that you mentioned and cpu context information), and adding more
> features such as instruction-level replay of a domain's execution
> environment.  So keep watching and hopefully there will be some more
> interesting stuff coming down the pipe.

Just a heads-up that some people have been looking at deterministic replay, so 
you might want to figure out who they are and see what stage they're at.

A filter-style interface for collecting selected events from Xen (as proposed 
by Stanford guys in the introspection paper) would be a nice thing to have 
too.  Stuff like direct syscall monitoring could be implemented this way, for 
instance.

Sounds like you've got a whole load of good plans, anyhow.  I wish you luck!

Cheers,
Mark

-- 
Dave: Just a question. What use is a unicyle with no seat?  And no pedals!
Mark: To answer a question with a question: What use is a skateboard?
Dave: Skateboards have wheels.
Mark: My wheel has a wheel!

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users