Infrastructure for Capturing and Persisting Virtualization-Specific Events Triggered by In-Guest Process Executions for Behavioral-Based Analysis

Virtualization based-approaches have become very popular in the implementation of intrusion detection systems (IDS). Behavioral datasets of malicious software can be used for training a model which can then be used by the security solution. There are very few publicly known and relevant datasets, that contain virtualization event information, from which one can build such a model, so the current paper proposes an open design for an infrastructure capable of recording and storing application behavioral events in order to train a security-oriented machine learning solution. The proposed infrastructure consists of a hypervisor that is run on an end-user system and the necessary software that controls the activation, interception and storage of virtualization events from which one can build the relevant datasets.