Open Access Open Access  Restricted Access Subscription or Fee Access

Malware Clearance for Secure Commitment of OS-Level Virtual Machines

A. Vidhya, R. Rajeswari


The number and complexity of attacks on computer systems are increasing. This growth necessitates proper defense mechanisms. Intrusion detection systems play an important role in detecting and disrupting attacks before they can compromise software. The Secom prototype can effectively eliminate malicious state changes while committing a VM with small performance degradation. The Secom prototype has a smaller number of false negatives and thus can more thoroughly clean up malware side effects. In addition, the number of false positives of the Secom prototype is also lower than that achieved by the online behavior-based approach of the commercial tools. Multivariant execution is an intrusion detection mechanism that executes several slightly different versions, called variants, of the same program in lockstep. The variants are built to have identical behavior under normal execution conditions. However, when the variants are under attack, there are detectable differences in their execution behavior. At runtime, a monitor compares the behavior of the variants at certain synchronization points and raises an alarm when a discrepancy is detected. The project presents a monitoring mechanism that does not need any kernel privileges to supervise the variants. Many sources of inconsistencies, including asynchronous signals and scheduling of multithreaded or multiprocess applications, can cause divergence in behavior of variants. These divergences cause false alarms.


False Positives, Kernel Privileges, Malicious State Changes, Multivariant Execution.

Full Text:



S.T. King and P.M. Chen (2003) “Backtracking Intrusions”, Proc. ACM Symp. Operating Systems Principles (SOSP), pp. 223-236.

D. Price and A. Tucker (2004) “Solaris Zones: Operating System Support for Consolidating Commercial Workloads”, Proc. 18th Large Installation System Administration Conf., pp. 241-254.

Poul-Henning Kamp, Robert N. M. Watson (2000) “Jails: Confining the omnipotent root”, The FreeBSD Project.

R. Paleari, L. Martignoni, E. Passerini, D. Davidson, M. Fredrikson, J. Giffin, and S. Jha (2010) “Automatic Generation of Remediation Procedures for Malware”, Proc. USENIX Conf. Security.

W. Sun, R. Sekar, and V.N. Venkatakrishnan (2005) “One-Way Isolation: An Effective Approach for Realizing Safe Execution Environments”, Proc. 12th ISOC Network and Distributed Systems Symp. (NDSS), pp. 265-278.

S. Soltesz, H. Po¨tzl, M.E. Fiuczynski, A. Bavier, and L. Peterson (2007) “Container-Based Operating System Virtualization: A Scalable, High-Performance Alternative to Hypervisors”, Proc. Second ACM European Conf. Computer Systems.

Y. Yu, F. Guo, S. Nanda, L. Lam, and T. Chiueh (2006) “A Feather-Weight Virtual Machine for Windows Applications”, Proc.Second Int’l Conf. Virtual Execution Environments (VEE), pp. 24-34.

Zhendong Su, Chen, Hsu, Jason Li, Ristenpart, (2005) “Back to the Future: A Framework for Automatic Malware Removal and System Repair”, Proc.University of California, Davis



  • There are currently no refbacks.

Creative Commons License
This work is licensed under a Creative Commons Attribution 3.0 License.