TY  - JOUR
A1  - Westphal, Florian
A1  - Axelsson, Stefan
A1  - Neuhaus, Christian
A1  - Polze, Andreas
T1  - VMI-PL: A monitoring language for virtual platforms using virtual machine introspection
JF  - Digital Investigation : the international journal of digital forensics & incident response
N2  - With the growth of virtualization and cloud computing, more and more forensic investigations rely on being able to perform live forensics on a virtual machine using virtual machine introspection (VMI). Inspecting a virtual machine through its hypervisor enables investigation without risking contamination of the evidence, crashing the computer, etc. To further access to these techniques for the investigator/researcher we have developed a new VMI monitoring language. This language is based on a review of the most commonly used VMI-techniques to date, and it enables the user to monitor the virtual machine's memory, events and data streams. A prototype implementation of our monitoring system was implemented in KVM, though implementation on any hypervisor that uses the common x86 virtualization hardware assistance support should be straightforward. Our prototype outperforms the proprietary VMWare VProbes in many cases, with a maximum performance loss of 18% for a realistic test case, which we consider acceptable. Our implementation is freely available under a liberal software distribution license. (C) 2014 Digital Forensics Research Workshop. Published by Elsevier Ltd. All rights reserved.
KW  - Virtualization
KW  - Security
KW  - Monitoring language
KW  - Live forensics
KW  - Introspection
KW  - Classification
Y1  - 2014
U6  - https://doi.org/10.1016/j.diin.2014.05.016
SN  - 1742-2876
SN  - 1873-202X
VL  - 11
SP  - S85
EP  - S94
PB  - Elsevier
CY  - Oxford
ER  -