(Short Paper) Evidence Collection and Preservation System with Virtual Machine Monitoring

• 資料種別: 図書
• タイトル: (Short Paper) Evidence Collection and Preservation System with Virtual Machine Monitoring
• 著者・編者: Nakamura, Toru; Ito, Hiroshi; Kiyomoto, Shinsaku; Yamauchi, Toshihiro
• 著者標目: Nakamura, Toru; Ito, Hiroshi; Kiyomoto, Shinsaku; Yamauchi, Toshihiro
• 出版事項: Springer International Publishing
• 出版年月日等: 2021-08-27
• 出版年（W3CDTF）: 2021-08-27
• タイトル（掲載誌）: Advances in Information and Computer Security|Lecture Notes in Computer Science
• 巻号年月日等（掲載誌）: 12835
• 掲載巻: 12835
• 掲載ページ: 64-73
• ISSN（掲載誌）: ISSN : 0302-9743
• 本文の言語コード: eng
• 件名標目: Virtual machine introspection; Forensics; OS security
• 対象利用者: 一般
• 一般注記: 出版タイプ： AM; In a system audit and verification, it is important to securely collect and preserve evidence of execution environments, execution processes, and program execution results. Evidence-based verification of program processes ensures their authenticity; for example, the processes include no altered/infected program library. This paper proposes a solution for collection of evidence on program libraries based on Virtual Machine Monitor (VMM). The solution can solve semantic gap by obtaining library file path names. This paper also shows a way to obtain hash values of library files from a guest OS. Furthermore, this paper provides examples of evidence on program xecution and the overhead of the solution.
• オンライン閲覧公開範囲: インターネット公開
• 著作権情報: © Springer Nature Switzerland AG 2021
• 関連情報（DOI）: 10.1007/978-3-030-85987-9_4; https://doi.org/10.1007/978-3-030-85987-9_4
• 関連情報（NCID）: BC11247320; https://ci.nii.ac.jp/ncid/BC11247320
• 連携機関・データベース: 国立情報学研究所 : 学術機関リポジトリデータベース（IRDB）（機関リポジトリ）; https://irdb.nii.ac.jp
• 提供元機関・データベース: 岡山大学 : 岡山大学学術成果リポジトリ