A Proactive Forensics Approach for Virtual Machines via Dynamic and Static Analysis
Bo Hu, Nan Li, Zhiyong Liu, Min Li, Chao Liu · 2016
Recent years witness the prevalence of IaaS (Infrastructure as a Service) cloud services. Virtual machines (VMs) are provided to users as a kind of product by IaaS providers. New computing architecture makes it difficult for traditional forensics tools to collect evidences from the target VM. In this paper, we propose a novel proactive forensic approach named VMForensics, which provides both dynamic and static analysis for virtual machines. To enable deep analysis, a proper triggering condition is defined and injected into VMForensics dynamic check module to get the needed evidences. VMForensics also gives protection for the data and codes to ensure the evidence integrity by means of raising a validity check module. A prototype of VMForensics is implemented on the XEN hypervisor, and its effectiveness and performance have been evaluated through comprehensive experiments. The results show that VMForensics can successfully detect the trigger condition, analyze the target VM and save the data in a secure format. It only brings about 5% overhead with normal frequency real-time detection.