Xi Tan

PHD in Computer Science and Engineering, University at Buffalo

PHD in Computing and Information Sciences, Rochester Institute of Technology

M.S. in Institute of Information Engineering(IIE), Chinese Academy of Sciences

System security with a focus on embedded systems

• ARM Cortex-M embedded systems are widely used nowadays. Due to their resource restrictions and real-time properties, security mechanisms are usually not provided on such system, which renders them insecure. My research goal is to enhance the security of such platforms via new novel solutions at compiler (LLVM) and OS layers (using MPU, IDAU, etc).

Virtual Machine Introspection (VMI) Based Malware Detection

• Research significance and goals: There is no mature detection system for a variety kinds of virtual machines (VMs) and putting agents in virtual machines costs much and hard to maintain. This project was to build a malware detection system (called it VIDS) for virtual machines including Linux and Windows without agents.
• Challenges and solutions:
  • Communicating with VMs to access the memory by modifying QMP protocol of QEMU.
  • Reading memory of VMs outside of them without agents by using VMI conception.
  • Classifying the detection target by conclusion crucial kernel data structures based on Rootkits' functions (process-hiding, modules-hiding, syscall-hijack, etc) for both Linux (task_struct, kobject, etc.) and Windows (EPROCESS, etc.) systems.
  • Combining forensic technique with VMI technique to reach an online memory analysis to detect malware to fix the semantic gap problem.
• Advantages: Transparent to VMs, accuracy detection, modular with python language, variety detection platforms including Linux and Windows.
• Disadvantages: Only memory related attacks detection, performance costs in host system, secure VMI.
• Extension project - Cloud Security Monitoring Center: combined HIDS, NIDS, and VIDS to-gether to monitor the whole cloud environment including VMs, servers, and network traffics, alongwith a Data Visualization Platform to show the monitoring results.

Online Experiment System Based on Hybrid Virtualization

• A research project aim to help the security education: clients for students to do attack exercises, which should be lightweight and easy to maintain; servers for target drone and management. Focused on virtualization technologies, and learned KVM and Docker's core architectures.
• Built in B + C/S architecture with a virtualization platform based on KVM and Docker to achieve the distribution and control of containers.