Memory Forensics Using Virtual Machine Introspection for Cloud Computing
summary
A working prototype implements memory-forensics-as-a-service by adding per-node forensic services to an OpenNebula cloud and using LibVMI with Xen to collect live RAM and feed Volatility for analysis. The claim is trustworthy, non‑invasive memory acquisition (no guest agents or tampering) with minimal measured overhead in prior tests; the prototype performs on‑node analysis to reduce network transfer. Practical limits include added attack surface, strict user segregation needs, and configuration/installation overhead for providers.
AI-written summary · about
chapters (17)
- 0:00Start
- 2:41OUTLINE
- 3:05MOTIVATION
- 4:21VIRTUAL MACHINE INTROSPECTION
- 4:46NATIVE VS. HOSTED VIRTUALIZATION
- 5:22SEMANTIC GAP
- 6:25HOW DOES IT WORK
- 11:03COUNTERMEASURES
- 12:40FIELDS OF APPLICATION
- 14:32SOLUTION APPROACH
- 15:11USE CASE
- 15:52COMPONENTS
- 18:02OPEN NEBULA EXTENSIONS
- 18:42MEMORY FORENSIC SERVICES
- 21:44DISADVANTAGES & CHALLENGES
- 23:37SUMMARY
- 24:41BLACK HAT SOUND BYTES
related talks
01h 03mInvestigating Malware Using Memory Forensics - A Practical Approach
30mMicro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks
14mInside Out: A Paradigm Shift in VM Introspection
19mSupporting Trusted Virtual Machines with Hardware-based Secure Remote Memory
44mAdvancements in Confidential Computing
19mEnabling Big Memory workloads to run
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
13mVM Security with Confidential Computing