Virtual Machine Introspection based Intrusion Detection System

I assure the single handed composition of this diploma thesis only supported by de-clared resources. Ich versichere, dass ich diese Diplomarbeit selbständig verfasst und nur die angegebe-nen Quellen und Hilfsmittel verwendet habe. Datum, Unterschrift 2 Intrusion Detection is a widespread topic in current security research. Common intrusion detection systems (IDSs) today are either host-based or network-based. Designers of both host-based and network-based IDSs have to trade a complete view over the monitored machine, the advantage of host-based IDSs, off against the system's tamper resistance, the advantage of network-based IDSs. The term virtual machine introspection (VMI) de-scribes an approach of monitoring the state of a machine using virtualization techniques and analysing the state of the introspected machine from the hy-pervisor's point of view. VMI-based intrusion detection systems combine th