Transcall

Transcall provides a VM shadow, which runs IDSes offloaded to another VM without any modification. It emulates system calls issued by IDSes and returns information on the operating system of the monitored VM. Also, it provides the same file systems with the monitored VM, including the proc file system. For security, it provides IDS executables, libraries, and configuration files from the VM running the IDSes. Currently, a VM shadow can run chkrootkit, Tripwire, etc.

Requirement

• Target System
  • Xen 3.4 and 4
  • Domain U: Linux 2.6.27.35
• Package
  • FUSE: Filesystem in Userspace

Source Code

• transcall-1.3.4.tar.gz

Contact

• kourai _at_ ci.kyutech.ac.jp