Automated detection of persistent kernel control-flow attacks 论文

2007引用 298

Security and Verification in ComputingAdvanced Malware Detection TechniquesNetwork Security and Intrusion Detection

网络安全 Security and Verification in Computing Network Security and Intrusion Detection Advanced Malware Detection Techniques

关系图谱

作者

摘要

This paper presents a new approach to dynamically monitoring operating system kernel integrity, based on a property called state-based control-flow integrity (SBCFI). Violations of SBCFI signal a persistent, unexpected modification of the kernel's control-flow graph. We performed a thorough analysis of 25 Linux rootkits and found that 24 (96%) employ persistent control-flow modifications; an informal study of Windows rootkits yielded similar results. We have implemented SBCFI enforcement as part of the Xen and VMware virtual machine monitors. Our implementation detected all the control-flow modifying rootkits we could install, while imposing unnoticeable overhead for both a typical web server workload and CPU-intensive workloads when operating at 10 second intervals.

作者查看全部 (2)

Michael Hicks

Nick L. Petroni

Automated detection of persistent kernel control-flow attacks 论文

详细信息

摘要

作者查看全部 (2)

相关技术查看全部 (2)

相关事件

相关文章