DMCA
OS-SOMMELIER: Memory-Only Operating System Fingerprinting in the Cloud
| Citations: | 10 - 6 self |
BibTeX
@MISC{Gu_os-sommelier:memory-only,
author = {Yufei Gu and Yangchun Fu and Aravind Prakash and Zhiqiang Lin and Heng Yin},
title = {OS-SOMMELIER: Memory-Only Operating System Fingerprinting in the Cloud},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Precise fingerprinting of an operating system (OS) is critical to many security and virtual machine (VM) management applications in the cloud, such as VM introspection, penetration testing, guest OS administration (e.g., kernel update), kernel dump analysis, and memory forensics. The existing OS fingerprinting techniques primarily inspect network packets or CPU states, and they all fall short in precision and usability. As the physical memory of a VM is always present in all these applications, in this paper, we present OS-SOMMELIER, a memory-only approach for precise and efficient cloud guest OS fingerprinting. Given a physical memory dump of a guest OS, the key idea of OS-SOMMELIER is to compute the kernel code hash for the precise fingerprinting. To achieve this goal, we face two major challenges: (1) how to differentiate the main kernel code from the rest of code and data in the physical memory, and (2) how to normalize the kernel code to deal with practical issues such as address space layout randomization. We have designed and implemented a prototype system to address these challenges. Our experimental results with over 45 OS kernels, including Linux, Windows, FreeBSD, OpenBSD and NetBSD, show that our OS-SOMMELIER can precisely fingerprint all the tested OSes without any false positives or false negatives, and do so within only 2 seconds on average.
Keyphrases
system fingerprinting physical memory precise fingerprinting network packet virtual machine cpu state penetration testing o administration guest o main kernel code memory forensics o kernel many security operating system practical issue prototype system memory-only approach key idea present os-sommelier efficient cloud vm introspection o fingerprinting address space layout randomization dump analysis physical memory dump major challenge false positive experimental result kernel code hash kernel code false negative management application tested os
