{"id":{"repo_id":"uiuc","oai_identifier":"oai:www.ideals.illinois.edu:2142/92849"},"canonical_url":"https://search.dev.ndltd.org/etd/uiuc/oai:www.ideals.illinois.edu:2142/92849","repository":{"repo_id":"uiuc","name":"University of Illinois - Urbana-Champaign","base_url":"https://www.ideals.illinois.edu/oai-pmh"},"display":{"title":"An architecture for trustworthy services built on event based probing of untrusted guests","abstract":"Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2016-11-09 without embargo terms","abstract_html":"Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2016-11-09 without embargo terms","abstract_has_math":false,"creators":["Sprabery, Read T"],"institution":"University of Illinois at Urbana-Champaign","degree_name":"M.S.","degree_level":"Thesis","degree_discipline":"Computer Science","degree_department":null,"school":null,"contributors":["Campbell, Roy","Bobba, Rakesh"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2016,"date_issued":"2016-11-10T17:55:13Z","date_published":"2016-11-10T17:55:13Z","updated_at":"2026-07-22T22:26:35Z","subjects":["Intrusion Detection","Hypervisor","Trustworthy Logging"],"languages":["en"],"rights":["Copyright 2016 Read Sprabery"],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"http://hdl.handle.net/2142/92849","outbound_label":"Handle","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Campbell, Roy","Bobba, Rakesh"]},{"key":"dc:creator","label":"Author","values":["Sprabery, Read T"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date","label":"Dc Date","values":["2016-11-10T17:55:13Z","2016-07-18","2016-08"]},{"key":"dc:type","label":"Dc Type","values":["text"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Thesis"]},{"key":"thesis:degree_name","label":"Degree Name","values":["M.S."]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["University of Illinois at Urbana-Champaign"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Intrusion Detection","Hypervisor","Trustworthy Logging"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["en"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright 2016 Read Sprabery"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["http://hdl.handle.net/2142/92849"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2016-11-09 without embargo terms","The student, Read Sprabery, accepted the attached license on 2016-07-15 at 09:50.","The student, Read Sprabery, submitted this Thesis for approval on 2016-07-15 at 09:54.","This Thesis was approved for publication on 2016-07-18 at 10:31.","DSpace SAF Submission Ingestion Package generated from Vireo submission #9957 on 2016-11-09 at 10:25:13","Made available in DSpace on 2016-11-10T17:55:13Z (GMT). No. of bitstreams: 2 SPRABERY-THESIS-2016.pdf: 771136 bytes, checksum: 500ccd9d5e57c161be7dc2ab8f96c57c (MD5) LICENSE.txt: 4210 bytes, checksum: 09fdcf21aae49e8563bfc53cc23fd6ee (MD5) Previous issue date: 2016-07-18","Numerous event-based probing methods exist for cloud computing environments allowing a trusted hypervisor to gain insight into guest activities. Such event based probing has been shown to be useful for detecting attacks, system hangs through watchdogs, and also for inserting exploit detectors before a system can be patched, among others. In this paper, we illustrate how to use such probing for trustworthy logging and highlight some of the challenges that existing event based probing mechanisms do not address. These challenges include ensuring a probe inserted at given address is trustworthy despite the lack of attestation available for probes that have been inserted dynamically. We show how probes can be inserted to ensure proper logging of every invocation of a probed instruction. When combined with attested boot of the hypervisor and guest machines, we can ensure the output stream of monitored events is trustworthy. Using these techniques we build a trustworthy log of certain guest-system-call events powering a cloud-tuned Intrusion Detection System (IDS). Additionally, we identify new types of events that must be added to existing probing systems to ensure attempts to circumvent probes within the guest appear in the log. We highlight the overhead penalties paid by guests to ensure log completeness when faced with probabilistic attacks and show promising results (less that 10% for guests) when a guest is willing to relax the trade-off between log completeness and overhead. Our demonstrative IDS shows the ability to detect common attack scenarios with simple policies built using our guest behavior recording system."]},{"key":"dc:format","label":"Dc Format","values":["application/pdf"]},{"key":"dc:title","label":"Title","values":["An architecture for trustworthy services built on event based probing of untrusted guests"]}]}],"canonical_facts":{"dc:contributor":["Campbell, Roy","Bobba, Rakesh"],"dc:creator":["Sprabery, Read T"],"dc:date":["2016-11-10T17:55:13Z","2016-07-18","2016-08"],"dc:description":["Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2016-11-09 without embargo terms","The student, Read Sprabery, accepted the attached license on 2016-07-15 at 09:50.","The student, Read Sprabery, submitted this Thesis for approval on 2016-07-15 at 09:54.","This Thesis was approved for publication on 2016-07-18 at 10:31.","DSpace SAF Submission Ingestion Package generated from Vireo submission #9957 on 2016-11-09 at 10:25:13","Made available in DSpace on 2016-11-10T17:55:13Z (GMT). No. of bitstreams: 2 SPRABERY-THESIS-2016.pdf: 771136 bytes, checksum: 500ccd9d5e57c161be7dc2ab8f96c57c (MD5) LICENSE.txt: 4210 bytes, checksum: 09fdcf21aae49e8563bfc53cc23fd6ee (MD5) Previous issue date: 2016-07-18","Numerous event-based probing methods exist for cloud computing environments allowing a trusted hypervisor to gain insight into guest activities. Such event based probing has been shown to be useful for detecting attacks, system hangs through watchdogs, and also for inserting exploit detectors before a system can be patched, among others. In this paper, we illustrate how to use such probing for trustworthy logging and highlight some of the challenges that existing event based probing mechanisms do not address. These challenges include ensuring a probe inserted at given address is trustworthy despite the lack of attestation available for probes that have been inserted dynamically. We show how probes can be inserted to ensure proper logging of every invocation of a probed instruction. When combined with attested boot of the hypervisor and guest machines, we can ensure the output stream of monitored events is trustworthy. Using these techniques we build a trustworthy log of certain guest-system-call events powering a cloud-tuned Intrusion Detection System (IDS). Additionally, we identify new types of events that must be added to existing probing systems to ensure attempts to circumvent probes within the guest appear in the log. We highlight the overhead penalties paid by guests to ensure log completeness when faced with probabilistic attacks and show promising results (less that 10% for guests) when a guest is willing to relax the trade-off between log completeness and overhead. Our demonstrative IDS shows the ability to detect common attack scenarios with simple policies built using our guest behavior recording system."],"dc:format":["application/pdf"],"dc:identifier":["http://hdl.handle.net/2142/92849"],"dc:language":["en"],"dc:rights":["Copyright 2016 Read Sprabery"],"dc:subject":["Intrusion Detection","Hypervisor","Trustworthy Logging"],"dc:title":["An architecture for trustworthy services built on event based probing of untrusted guests"],"dc:type":["text"],"thesis:degree_discipline":["Computer Science"],"thesis:degree_level":["Thesis"],"thesis:degree_name":["M.S."],"thesis:institution_name":["University of Illinois at Urbana-Champaign"]},"updated_at":"2026-07-22T22:26:35Z"}