{"id":1102,"date":"2016-08-15T06:21:03","date_gmt":"2016-08-15T06:21:03","guid":{"rendered":"http:\/\/www.inforsec.org\/wp\/?p=1102"},"modified":"2016-12-29T08:36:45","modified_gmt":"2016-12-29T08:36:45","slug":"%e3%80%90%e6%b4%bb%e5%8a%a8%e9%a2%84%e5%91%8a%e3%80%918%e6%9c%8818%e6%97%a5intel%e5%ae%9e%e9%aa%8c%e5%ae%a4%e6%9d%8e%e6%99%93%e5%ae%81%e4%b8%8e%e6%82%a8%e7%9b%b8%e7%ba%a6%e6%b8%85%e5%8d%8e","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=1102","title":{"rendered":"\u3010\u6d3b\u52a8\u9884\u544a\u30118\u670818\u65e5Intel\u5b9e\u9a8c\u5ba4\u674e\u6653\u5b81\u4e0e\u60a8\u76f8\u7ea6\u6e05\u534e"},"content":{"rendered":"

\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u5b66\u672f\u62a5\u544a<\/strong><\/p>\n

Intel \u5b9e\u9a8c\u5ba4 Xiaoning Li @InForSec<\/strong><\/p>\n

\u65f6\u95f4\uff1a2016\u5e748\u670818\u65e5\uff08\u5468\u56db\uff0910:00-12:00<\/strong><\/p>\n

\u5730\u70b9\uff1a\u6e05\u534e\u5927\u5b66\u4fe1\u606f\u6280\u672f\u5927\u697c\uff08FIT\uff09 3-225<\/strong><\/p>\n

\u6f14\u8bb2\u4eba\uff1a \u674e\u6653\u5b81 Intel\u5b9e\u9a8c\u5ba4\u5b89\u5168\u7814\u7a76\u5458\/ \u67b6\u6784\u5e08<\/strong><\/p>\n

\u4e3b\u9898\uff1aBuilding a fundamentally improved malware analysis sandbox without virtualization<\/strong><\/p>\n

\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n

Today hardware virtualization based appliances are an important component in enterprise defense landscape. To catch malware specifically APT attacks, virtual appliance systems play a critical role to be able to analyze samples, collect runtime behavior and indicate level of maliciousness.<\/p>\n

<\/p>\n

Virtual appliance systems leverage the advantages from HW and SW virtualization systems such as known-clean image recovery, runtime inspection using hypervisors and so on. But at the same time, we have to accept the weakness of virtual systems because there are too many signatures from virtual systems including specific device names, device properties, VMM behaviors, and even side effects from instruction execution on virtual platforms. In the past years, we have seen many malware samples such as Smokeloader that have begun to “detect” virtual systems. We have also published [Ref] couple new approaches to detect SW and HW virtual systems.<\/p>\n

To select an ideal virtual system to host a malware sandbox analysis system, we need native and light-weight in-memory inspection techniques alongwith the ability to rapidly recover known-clean images. If we can build these capabilities in a native system without any virtualization then we can significantly reduce the impact of sandbox analysis.<\/p>\n

To address these challenges, we present the design of a specific bare metal system to provide bare-metal malware inspection and rapid OS recovery, alongwith techniques for leveraging these capabilities for malware analysis. In this talk, we will describe how we achieve this goal and results from this system.<\/p>\n

\u4e2a\u4eba\u7b80\u4ecb\uff1a<\/strong><\/p>\n

\"\u56fe\u72471\"<\/a><\/p>\n

Xiaoning Li is a security researcher and architect at Intel Labs and focuses on analyzing\/detecting\/preventing 0 day\/malware with existing\/new processor features. For the past 10+ years, his work has been focusing on both hardware\/software security system co-design and advanced threat research. Xiaoning holds 20+ grant\/filling patents in security areas including processor\/system security and has published more than 20+ conference\/invited talks including BlackHat, CanSecWest, ShmooCon, Source etc.<\/p>\n

\u8054\u7cfb\u4eba\uff1a \u6bb5\u6d77\u65b0,duanhx@tsinghua.edu.cn<\/p>\n

\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662<\/p>\n","protected":false},"excerpt":{"rendered":"

\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u5b66\u672f\u62a5\u544a Intel \u5b9e\u9a8c\u5ba4 Xiaoning Li @InForSec \u65f6\u95f4\uff1a2016… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-1102","post","type-post","status-publish","format-standard","hentry","category-information"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1102"}],"version-history":[{"count":1,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1102\/revisions"}],"predecessor-version":[{"id":1104,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1102\/revisions\/1104"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1102"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}