Pre-Grant Publication Number: 20090158432
Please help the USPTO examine the application by evaluating the relevance of the publicly submitted prior art to the patent application.
Peer To Patent forwards the Top 10 most relevant prior art submissions and their annotations to the USPTO.
Review this prior art and click on the thumbs up (or down) to indicate whether this submission should be forwarded to the USPTO.
If you login then you can add an annotation by typing in the box at the bottom of the screen to comment on the relevance of the prior art to the claims of the patent application.
Review this prior art and click on the thumbs up (or down) to indicate whether this submission should be forwarded to the USPTO.
If you login then you can add an annotation by typing in the box at the bottom of the screen to comment on the relevance of the prior art to the claims of the patent application.
Prior Art Detail
Summary / Description
| Summary / Description | Discloses an architecture that retains the visibility of a host-based IDS, but pulls the IDS outside of the host for greater attack resistance using a virtual machine monitor. |
Basic Information
| Type of Prior Art | Online Publication |
| URL | http://citeseerx.ist.psu.edu/vi... |
| Author/Creator | Garfinkel, et al. |
| Title | A Virtual Machine Introspection Based Architecture for Intrusion Detection |
| Publication Date | 2003 |
| Publisher | Proc. Network and Distributed Systems Security Symposium |
| Directions to Document Location | |
| Additional Information | |
Notes / To Do
| Notes | |
Excerpt
Excerpt In this paper we present an architecture that retains the visibility of a host-based IDS, but pulls the IDS outside of the host for greater attack resistance. We achieve this through the use of a virtual machine monitor. Using this approach allows us to isolate the IDS from the monitored host but still retain excellent visibility into the host's state. The VMM also offers us the unique ability to completely mediate interactions between the host software and the underlying hardware. We present a detailed study of our architecture, including Livewire, a prototype implementation. We demonstrate Livewire by implementing a suite of simple intrusion detection policies and using them to detect real attacks. |
Relevance
Claims
1
Relevance
See sec. 6.13 (p.9): Scanning the file system for the presence of known malicious program based on a known “signature” substring of the program is a popular intrusion detection technique. It is employed by anti-virus tools as well as root-kit detection tools like chkrootkit [31]. ...
See sec. 6.13 (p.9): Scanning the file system for the presence of known malicious program based on a known “signature” substring of the program is a popular intrusion detection technique. It is employed by anti-virus tools as well as root-kit detection tools like chkrootkit [31]. ...
Claim Chart
All
