Hypervisor Assisted Forensics and Incident Response in the Cloud

Cloud computing has been integrated into manyareas of production and received a great amount of attention from both government and private industry. Despite its popularity, cloud technologies are still not well understood and numerous areas are open for research and development. One critical area that has not received significant attention in the security domain of cloud computing is digital forensics and incident response. In this paper we address the challenges in those domains by introducing a novel approach using virtual machine introspection to provide intelligence, introspection, and modification of VM state in cloud systems. The focus of this research paper provides:(1) the context for security in cloud and the challenges introduced by conducting digital forensics in the cloud, (2) new opportunities that exist to meet these challenges in the Cloud through virtual machine introspection, to include correlation with network data and active state modification, and (3) use-cases and experiment results for our techniques under the guise of Cloud forensics.