Detection of advanced security attacks that exploit zero-day vulnerabilities or application-specific logic loopholes has been challenging due to the lack of attack signatures or substantial deviations in the overall system behavior. One has to zoom in to the affected code regions and look for local anomalies distinguishable from the benign workload to detect such attacks. We proposepervasive micro information flow tracking(PerMIT) that realizes variable-level online dynamic information flow tracking (DIFT) as a means to detect the attacks. The system uses hardware virtualization extension to monitor access to taint source variables and performs asynchronous code emulation to infer the local information flow. We demonstrate that the pervasive micro information flow can sufficiently capture the attacks and incurs only a small overhead. Given the program source code, the system can further enrich the semantics of micro information flow by embedding the variable names. We have integrated the system with machine learning algorithms to demonstrate the effectiveness of anomaly detection for zero-day attacks with pervasive micro information flow.

The abundance of highly sensitive personal information in the Health Information System (HIS) has made it a prime target of data breach attacks. However, securing the system with existing Data Leakage Prevention (DLP) solutions is difficult due to a lack of security perimeter and diverse composition of software components. We propose the use of hypervisor-based memory introspection for implementing data leakage detection in such an environment. The approach looks for the presence of sensitive raw data in the memory of both the client machines and the server machines, transcending the dependence of pre-existing security perimeters. It is inherently compatible with different types of application software and robust against transport or at-rest data encryption. A prototype has been built on the Bareflank hypervisor and the OpenEMR platform. The evaluation results confirmed the effectiveness of the approach.

Sensitive Data Leakage (SDL) is a major issue faced by organizations due to increasing reliance on data-driven decision-making. Existing Data Leakage Prevention (DLP) solutions are being challenged by the adoption of network transport encryption and the presence of privileged-mode malware designed to tamper with the DLP agent programs. We propose a novel DLP system called "HyperSweep" that uses Virtual Machine Memory Introspection (VMI) technology to inspect the memory content of a guest system for sensitive information. The approach is robust against both network transport encryption and malware that attack DLP agent programs. The HyperSweep prototype is implemented on top of the KVM hypervisor. Our experiments have confirmed its applicability to real-world applications, including web browsers, office applications, and social networking applications. The experiments also indicate moderate performance overhead from applying HyperSweep.

Vehicular Ad-hoc Network (VANET) cloud, a hybrid technology, provides several computational services to minimize traffic congestion, travelling time, accidents, and environmental pollution. In the proposed work, the concept of VANET cloud is used for helping the regulatory authorities in identifying the vehicles violating the traffic rules through sensors included as part of On Board Unit (OBU). When the vehicle is on fly the sensor values are periodically transferred to the cloud, controlled by the traffic police. A novel concept called Transient Ticket (TT) has been used to minimize the time and the cost of distributing Certificate Revocation List (CRL) to the vehicles. The proposed scheme also ensures utmost verification of identity, authenticity, confidentiality and integrity of the communication parties and messages exchanged. The work has been simulated using NS3 network simulator and Google App Engine (GAE). All the generated keys, TTs and the exchanged messages have been securely stored in the GAE for the ease of accessibility and processing. The results show that the proposed approach consumes very less time with respect to the generation of keys, exchange of messages, verification of authenticity and the generation of TT without compromising security.