Abstract

In system audits and verifications, it is critical to collect logs and preserve them as evidence of execution environments, processes, and program results. To effectively use logs as evidence, the authenticity of the logs, files, and other information related to program execution must be ensured. Unlike previous systems that modify guest-operating systems, this paper introduces a new system that utilizes a virtual machine (VM) monitor (VMM) to preserve evidence of program execution, extending the scope of evidence collection beyond standard system-call arguments. The proposed system uses VMM to isolate the acquired information and its acquisition mechanism from the monitored guest-operating system. This paper presents a solution to the semantic gap issue for information that could be required as evidence. Moreover, it provides examples of program-execution evidence and demonstrates that it can detect specific attacks. Furthermore, we report the results of measuring the performance overhead of benchmark programs and the kernel-based VM compilation processing. The findings demonstrate that the proposed evidence collection and preservation system effectively detects sophisticated attacks, such as CVE-2021-4034, enhances system security through tamper-resistant evidence collection, and maintains practicality with minimal overhead for applications with infrequent system calls.