People » Jonas Pfoh
| Address: | Technische Universität München Chair for IT Security (I20) Boltzmannstraße 3 85748 Garching (near Munich) Germany |
| Phone: | +49 (0)89 289-18583 |
| Fax: | +49 (0)89 289-18579 |
| E-Mail: | pfoh@sec.in.tum.de |
| Room: | 01.08.057 |
My current interests lie in the field of virtual machine introspection and how this can be used in novel ways to improve current intrusion detection methods.
Intrusion detection through virtual machine introspection provides many advantages over standard host-based intrusion detection systems (IDSs) in that one can avoid the “observer effect”, the IDS itself is not susceptible if the host in question is subverted, and the virtual machine monitor (VMM) allows one a view of the host at the lowest level.
The challenge becomes interpreting the massive amount of data one has access to at such a low level. Current approaches use very tried and true IDS mechanisms by monitoring key kernel data structures for example. My goal is to contribute to this field by really taking advantage of the low-level view a VMM has and making meaningful inferences about a host's state.