SAV-V: Securing Anti-Virus with Virtualization
Jacob R. Lorch, Bryan Jeffery Parno, Helen J. Wang · 2007
Today’s desktop PCs rely on security software such as anti-v irus products and personal firewalls for protection. Unfortunately, malware authors have adapted by specifically targeting and disabling these defenses, a practice exacerbated by the rise in zero-day exploits. In this paper, we present the design, implementation, and evaluation of SAV-V, a platform that enhances the detection capabilities of antivirus software. Our platform leverages virtualization to p reserve the integrity of AV software and to guarantee access to AV updates. SAV-V also uses secure logging and a split file system to preserve the fidelity of input to the AV program. Combined with our technique of fake shutdowns, these measures allow SAV-V to eventually detect any zero-day malware that writes to disk. Benchmarks of our prototype system suggest that SAV-V can be implemented efficiently, an d we validate our prototype by testing it against real-world malware.