LinuxCon + CloudOpen + ContainerCon NA 2015

Mihai's presentation details a practical approach to memory introspection of virtual machines running on the Xen hypervisor with no in-guest footprint. Making use of the mem-event API, with a number of improvements, enables the proper tracking of guest OS activity. This opens the door for several immediate applications, including: rootkit detection and prevention, detection and action on several categories of malware, and event source information for low-level, post-event forensics and correlation based on real event data during events.