Internship Programmes
 
Malware Detection Using KVM (Kernel-based Virtual Machine)

Discipline: Computer Engineering/Computer Science/Electrical Engineering preferred

Project Description:
KVM (Kernel-based Virtual Machine) is a component of the Linux Kernel that provides a virtual environment to run a separate OS in an existing OS.   Is it possible to use this virtualization approach to detect the existence of malware in the virtualized OS?

The candidate will design a framework – utilizing hardware/software virtualization technology to detect malware execution.   The emphasis is on establishing a framework for detection, facilitating future addition of malware detection algorithm.   For this project only one or two detection algorithm is expected.   It is also good to know that similar requirements are being sought after currently in the open source community – where they can contribute their knowledge gained after the project.

(http://kernelnewbies.org/KernelProjects, http://kvm.qumranet.com/kvmwiki/TODO).

The challenges of the project are:
1) Achieve a good understanding of the overall architecture of Linux Kernel, and KVM.
2) Understand the key concepts in virtualization.
3) Setup and run KVM in the kernel, and subsequently install a Linux OS.  
4) Design a framework for malware detection.
5) Patch the existing KVM component of the Linux Kernel to enable in-kernel malware detection.

Pre-requisite :
Strong C programming
- Linux administration/user experience
- Linux Kernel Programming – preferable.
- Concepts of Operating System