(Short Paper) Evidence Collection and Preservation System with Virtual Machine Monitoring

Material type: 図書

Author: Nakamura, Toruほか

Publisher: Springer International Publishing

Publication date: 2021-08-27

Material Format: Digital

Capacity, size, etc.: -

NDC: -

View All

Notes on use

Note (General)：: In a system audit and verification, it is important to securely collect and preserve evidence of execution environments, execution processes, and prog...

Search by Bookstore

Holdings of Libraries in Japan

This page shows libraries in Japan other than the National Diet Library that hold the material.

List of Cooperating Institutions and Databases

Please contact your local library for information on how to use materials or whether it is possible to request materials from the holding libraries.

other

Okayama University Scientific Achievement Repository
Digital
You can check the holdings of institutions and databases with which 学術機関リポジトリデータベース（IRDB）（機関リポジトリ） is linked at the site of 学術機関リポジトリデータベース（IRDB）（機関リポジトリ）.
Okayama University Scientific Achievement Repository

Search by Bookstore

Bibliographic Record

You can check the details of this material, its authority (keywords that refer to materials on the same subject, author's name, etc.), etc.

Digital

Material Type: 図書
Title: (Short Paper) Evidence Collection and Preservation System with Virtual Machine Monitoring
Author/Editor: Nakamura, Toru
Ito, Hiroshi
Kiyomoto, Shinsaku
Yamauchi, Toshihiro
Author Heading: Nakamura, Toru
Ito, Hiroshi
Kiyomoto, Shinsaku
Yamauchi, Toshihiro
Publication, Distribution, etc.: Springer International Publishing
Publication Date: 2021-08-27
Publication Date (W3CDTF): 2021-08-27
Periodical title: Advances in Information and Computer Security|Lecture Notes in Computer Science
No. or year of volume/issue: 12835
Volume: 12835
Pages: 64-73
ISSN (Periodical Title): ISSN : 0302-9743
Text Language Code: eng
Subject Heading: Virtual machine introspection
Forensics
OS security
Target Audience: 一般
Note (General): In a system audit and verification, it is important to securely collect and preserve evidence of execution environments, execution processes, and program execution results. Evidence-based verification of program processes ensures their authenticity; for example, the processes include no altered/infected program library. This paper proposes a solution for collection of evidence on program libraries based on Virtual Machine Monitor (VMM). The solution can solve semantic gap by obtaining library file path names. This paper also shows a way to obtain hash values of library files from a guest OS. Furthermore, this paper provides examples of evidence on program xecution and the overhead of the solution.
Source: https://ousar.lib.okayama-u.ac.jp/files/public/6/63165/2023082809241023499/fulltext20220204-1.pdf
https://ousar.lib.okayama-u.ac.jp/files/public/6/63165/2023082809241023499/fulltext20220204-1.pdf
Access Restrictions: 限定公開
Related Material (DOI): 10.1007/978-3-030-85987-9_4
Related Material (NCID): BC11247320
https://ci.nii.ac.jp/ncid/BC11247320
Data Provider (Database): 国立情報学研究所 : 学術機関リポジトリデータベース（IRDB）（機関リポジトリ）
https://irdb.nii.ac.jp
Original Data Provider (Database): 岡山大学 : 岡山大学学術成果リポジトリ