Outline. Introduction. State-of-the-art Forensic Methods. Hardware-based Workload Forensics. Experimental Results. Summary. OS level Hypervisor level

Transcription

1 Outline Introduction State-of-the-art Forensic Methods OS level Hypervisor level Hardware-based Workload Forensics Process Reconstruction Experimental Results Setup Result & Overhead Summary 1

2 Introduction Motivation Vast amount of sensitive information is stored, processed and communicated in electronic form Intensified malicious efforts à unauthorized access Retroactive investigation needed Workload Forensics Collect data related to past execution of computer programs Analyze data to understand and/or reconstruct corresponding events 2

3 Outline Introduction State-of-the-art Forensic Methods OS level Hypervisor level Hardware-based Workload Forensics Process Reconstruction Experimental Results Setup Result & Overhead Summary 3

4 OS-level Forensic Methods Forensic module resides at the same level with applications/os kernel Signature comparison Memory image Commercial products (i.e. EnCase, FTK, etc.) Program behavior modeling System call pattern Involve machine learning/statistics OS app. app. Forensics app. While OS-level Forensic methods benefit from semantic-rich information, they are vulnerable to software attacks at the same level! C. Kolbitsch, et al. Effective and efficient malware detection at the end, USENIX,

5 Hypervisor-level Forensic Methods Forensic module resides at Hypervisor level Hypervisor Virtualization for OS Isolated management core provides better security Bridge semantic gap Process à dedicated addr. space & page table Page table base addr. (CR3 in x86) à process Similar methods as at OS-level can be performed Hypervisor OS OS Forensics OS Hypervisor-level Forensic methods are immune to OS-level attacks. Unfortunately, the hypervisor itself can be the attack surface! *D. Perez-Botero et al. Characterizing hypervisor vulnerabilities in cloud computing servers, SCC,

6 Outline Introduction State-of-the-art Forensic Methods OS level Hypervisor level Hardware-based Workload Forensics Process Reconstruction Experimental Results Setup Result & Overhead Summary 6

7 Why Hardware-based Forensics? user environment analysis environment software analysis module hardware Download data bus logging module Upload data bus A logging module at hardware level is expected to be immune to software-based tampering! 7

8 Process Reconstruction Challenge Three main questions: Data in HW à I.D.? Data in HW à behavior? process Analysis in SW à distinguish different processes? 8

9 Logging Module Logging Object CR3 value Identifier of the process Phase 1 Phase 2 Phase 3 Phase 2 Phase 3 Phase 1 User-space instruction raising itlb miss Behavior of the process Why TLB profile? CR3 change à TLB flush Accurate association between TLB events and CR3 value Mitigation of the effect of different program execution order T. Sherwood et al. Discovering and exploiting program phases, IEEE Micro,

10 CR3 value Instruction 1 Instruction 2 Instruction 100 Instruction 1 Instruction 2 Instruction 100 Logging Module Feature Extraction 10

11 Logging Module Feature Extraction CR3 value Instruction 1 Instruction 2 Instruction 100 update feature vector for each partition Operator counters Instruction 1 Instruction 2 Instruction class operators 1) Data manipulation operator 2) Stack manipulation operator 3) Arithmetic/logic calculation 4) Control flow operation 5) I/O operation 6) Floating point operation 11

12 Logging Module Feature Extraction CR3 value Instruction 1 Instruction 2 Instruction 100 update feature vector for each partition Operator counters Operand counters Instruction 1 Instruction 2 Instruction class operators 12-class operands 1) Data manipulation operator 2) Stack manipulation operator 3) Arithmetic/logic calculation 4) Control flow operation 5) I/O operation 6) Floating point operation 1-8) General purpose registers 9) Memory reference 10) XMM registers/floating point stack 11) All segment registers 12) Immediate value 12

13 Logging Module Feature Extraction CR3 value Instruction 1 Instruction 2 Instruction 100 Instruction 1 Instruction 2 Instruction 100 update feature vector for each partition Operator counters 6-class operators final feature vector list attached to this CR3 Operand counters 12-class operands F.V. 1 F.V. 2 F.V. end 1) Data manipulation operator 2) Stack manipulation operator 3) Arithmetic/logic calculation 4) Control flow operation 5) I/O operation 6) Floating point operation 1-8) General purpose registers 9) Memory reference 10) XMM registers/floating point stack 11) All segment registers 12) Immediate value 13

14 Processes Feature Vector Sample 1 Feature 1 Feature 2 Feature... Sample 2 Feature 1 Feature 2 Feature... Sample 3 Feature 1 Feature 2 Feature... Sample 4 Feature 1 Feature 2 Feature... Feature Matrix Analysis Module 14

15 Processes Feature Vector Sample 1 Feature 1 Feature 2 Feature... Sample 2 Feature 1 Feature 2 Feature... Sample 3 Feature 1 Feature 2 Feature... Sample 4 Feature 1 Feature 2 Feature... Feature Matrix Analysis Module? unseen process seen process 15

16 Processes Feature Vector Sample 1 Feature 1 Feature 2 Feature... Sample 2 Feature 1 Feature 2 Feature... Sample 3 Feature 1 Feature 2 Feature... Sample 4 Feature 1 Feature 2 Feature... Feature Matrix Analysis Module? unseen process seen process? process 1 process 2 process n 16

17 Processes Feature Vector Sample 1 Feature 1 Feature 2 Feature... Sample 2 Feature 1 Feature 2 Feature... Sample 3 Feature 1 Feature 2 Feature... Sample 4 Feature 1 Feature 2 Feature... Feature Matrix Analysis Module? Prob. estimates unseen process seen process Support Vector Machine (SVM)? process 1 process 2 process n k-nearest Neighbors (knn) 17

18 Outline Introduction State-of-the-art Forensic Methods OS level Hypervisor level Hardware-based Workload Forensics Process Reconstruction Experimental Results Setup Result & Overhead Summary 18

19 Experimental Setup Simulator Simics 4.86 Target Platform 32-bit x86 with single Intel Pentium 4 core, 2Ghz 4GB RAM Simulated Operating System (OS) Minimum installation Ubuntu server (Linux 2.6 kernel) Workload Benchmark Mibench 50% training, 50% validation Analysis Software Matlab 19

20 Results Outlier Detection Outlier Detection Accuracy 14% 12% 10% 8% 6% 4% 2% 0% FP rate FN rate test 1 test 2 test 3 test 4 average Test FP: seen process classified as unseen FN: unseen process classified as seen 20

21 Results Outlier Detection Outlier Detection Accuracy 14% 12% 10% 8% 6% 4% 2% 0% FP rate FN rate test 1 test 2 test 3 test 4 average Test FP: seen process classified as unseen FN: unseen process classified as seen Average FP rate: 12.31%; average FN rate: 5.13% 21

22 Results Workload Classification 100% Classification Accuracy 80% 60% 40% 20% 0% knn SVM Average classification accuracy: 96.97% for knn and 96.93% for SVM 22

23 Results Workload Classification 80% 60% 40% 20% 0% Classification Accuracy100% knn SVM benchmark Classification accuracy for some classes reaches 100% 23

24 Results Workload Classification knn SVM 80% 60% 40% 20% 0% Classification Accuracy100% benchmark Classification accuracy for some classes reaches 100% rawcaudio (ADPCM encoding algorithm) rawdaudio (decoding algorithm) à reduced classification efficiency due to similarity 24

25 Logging Overhead Steps to compute logging overhead: Feature Vector Size = 18 log 5 partition size itlb miss rate Partition generation rate = partition size Instruction 1 Instruction 2 Instruction 100 bits per instruction = Feature Vector size Partition generation rate esitimated logging rate(bits/second) = bits per instruction clock frequency CPI (assumed = 1) 25

26 Logging Overhead Steps to compute logging overhead: Feature Vector Size = 18 log 5 partition size itlb miss rate Partition generation rate = partition size Instruction 1 Instruction 2 Instruction 100 bits per instruction = Feature Vector size Partition generation rate esitimated logging rate(bits/second) = bits per instruction clock frequency CPI (assumed = 1) Computation result: Average itlb miss rate for user space instructions is % This leads to an estimated logging rate of only 5.17 KB/s 26

27 Outline Introduction State-of-the-art Forensic Methods OS level Hypervisor level Hardware-based Workload Forensics Process Reconstruction Experimental Results Setup Result & Overhead Summary 27

28 Contributions Summary First hardware-based method for workload forensics analysis Addresses the weakness of OS-level/hypervisor-level methods Demonstrates process reconstruction feasibility via TLB profiling Implementation Complete Hardware-to-Software logging-analysis flow Results High workload-classification accuracy Low logging overhead Future Work Investigate information theoretic content of other features Experiment with more advanced machine learning models 28