VMPmonitor: An Efficient Modularity Approach for Hidden Process Detection
Chaoyuan Cui, Wu Yun, Li Ping, Wang Rujing · Advances in intelligent systems research/Advances in Intelligent Systems Research · 2013
With the development of the Cloud computing, more and more people are accustomed to resource sharing or online shopping.And malware has become a major threat to the Cloud safety.Process hiding is a powerful technique commonly used by stealthy malware to evade detection by anti-malware.In this paper, we present a novel approach called VMPmonitor-an efficient modularity approach for hidden process detection.With the help of the guest OS register information (mainly the ESP) collected by virtual machine monitor, VMPmonitor can implicitly capture the hidden process information of target guest OS.Compared to other approaches, VMPmonitor obtains guest process information implicitly.Using implicit information reduces its susceptibility to guest evasion attack.Experimental result shows that VMPmonitor has better reliability and accuracy.