Using VisorFlow to Control Information Flow without Modifying the Operating System Kernel or its Userspace

VISORFLOW aims to monitor the flow of information between processes without requiring modifications to the operating system kernel or its userspace. VISORFLOW runs in a privileged Xen domain and monitors the system calls executing in other domains running either Linux or Windows. VISORFLOW uses its observations to prevent confidential information from leaving a local network. We describe the design and implementation of VISORFLOW, describe how we used VISORFLOW to confine naive users and malicious insiders during the 2017 Cyber-Defense Exercise, and provide performance measurements. We have released VISORFLOW and its companion library, libguestrace, as open-source software.