Automatic Mitigation of Kernel Rootkits in Cloud Environments

Grimm, Jonathan B.; Ahmed, Irfan; Roussev, Vassil; Bhatt, Manish; Hong, Manpyo

doi:10.1007/978-3-319-93563-8_12

Cited by 4 publications

(2 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…MOSKG [34] utilizes the virtualization technology to protect critical kernel data. Jonathan Grimm et al [10] present a rootkit defense mechanism based on the virtualization technology. In our previous work [28], we propose a virtualization-based protection mechanism against vulnerable kernel modules.…”

Section: Virtualization-based Methodsmentioning

confidence: 99%

A Kernel Rootkit Detection Approach Based on Virtualization and Machine Learning

Tian

Jia

2019

IEEE Access

View full text Add to dashboard Cite

OS kernel is the core part of the operating system, and it plays an important role for OS resource management. A popular way to compromise OS kernel is through a kernel rootkit (i.e., malicious kernel module). Once a rootkit is loaded into the kernel space, it can carry out arbitrary malicious operations with high privilege. To defeat kernel rootkits, many approaches have been proposed in the past few years. However, existing methods suffer from some limitations: 1) most methods focus on user-mode rootkit detection; 2) some methods are limited to detect obfuscated kernel modules; and 3) some methods introduce significant performance overhead. To address these problems, we propose VKRD, a kernel rootkit detection system based on the hardware assisted virtualization technology. Compared with previous methods, VKRD can provide a transparent and an efficient execution environment for the target kernel module to reveal its run-time behavior. To select the important run-time features for training our detection models, we utilize the TF-IDF method. By combining the hardware assisted virtualization and machine learning techniques, our kernel rootkit detection solution could be potentially applied in the cloud environment. The experiments show that our system can detect windows kernel rootkits with high accuracy and moderate performance cost.

show abstract

Section: Virtualization-based Methodsmentioning

confidence: 99%

A Kernel Rootkit Detection Approach Based on Virtualization and Machine Learning

Tian

Jia

2019

IEEE Access

View full text Add to dashboard Cite

show abstract

“…An alternative solution has been proposed by Grimm et al, 20 which seeks to automatically identify and disable rootkit malware by restoring normal system control flows. The system employed virtual machine (VM) introspection, which allows a privileged VM to view and manipulate the physical memory of other VMs with the aid of a hypervisor.…”

Section: Related Workmentioning

confidence: 99%

Nonvolatile kernel rootkit detection using cross‐view clean boot in cloud computing

Ramani

Kumar²

2019

Concurrency and Computation

View full text Add to dashboard Cite

Summary Malware attacks on kernel rootkits have become increasingly sophisticated and extremely difficult to detect; hence, they have a reign of power over the functionalities of the kernel. These kernel rootkits adopt stealth techniques to conceal the system processes, kernel modules, and other control structures, making it quite a challenge to detect their presence in the victim system. Many current efforts to detect the rootkits are based on known sources and are primarily system specific and hence are ineffective for newly mutating, hidden, and unknown rootkits. Therefore, in this paper, a kernel rootkit hidden file detection view (KRHFDV) system is proposed to detect such rootkits by identifying hidden files. This detection process uses a cross‐view clean‐boot‐based approach and defines a process monitoring framework that continuously maintains a list of active files and can detect both known and unknown rootkits with minimal performance overhead. KRHFDV overcomes the semantic gap by intercepting system call events of the tainted operating system in a nonintrusive manner and monitors the kernel to reconstruct a semantic‐level process information structure. The results from the extensive performance evaluation carried out with 64 rootkit samples in a cloud environment for both Linux and Windows kernels show that KRHFDV is able to identify file hiding behaviours of all samples in the least detection time.

show abstract

Evaluation of Peer Instruction for Cybersecurity Education

Deshpande

Lee

Ahmed

2019

Proceedings of the 50th ACM Technical Symposium on Computer Science Education

Self Cite

View full text Add to dashboard Cite

Peer instruction pedagogy is a student-centric approach that encourages students to read lecture material before coming to class and engages them in class via group discussion and preplanned conceptual questions. Peer instruction has shown promising results in core computer science courses such as eory of Computation and Computer Architecture, as well as reducing failure rates and improving student retention in computer science major. is paper presents the results of the rst-ever a empt to replicate these results in a cybersecurity course, using an action research methodology to implement and evaluate peer instruction in a semester-long cybersecurity course, Introduction to Computer Security. e evaluation consists of quizzes, subjective exams, peer instruction questions, and a itudinal surveys gathered over two control semesters and one peer instruction condition semester. We nd evidence of learning gains during group discussion and improvements in dropout and failure rates compared to traditional lecture classes. In a itudinal surveys, most students report that they would recommend that other instructors use peer instruction.

show abstract

Automatic Mitigation of Kernel Rootkits in Cloud Environments

Cited by 4 publications

References 10 publications

A Kernel Rootkit Detection Approach Based on Virtualization and Machine Learning

A Kernel Rootkit Detection Approach Based on Virtualization and Machine Learning

Nonvolatile kernel rootkit detection using cross‐view clean boot in cloud computing

Evaluation of Peer Instruction for Cybersecurity Education

Contact Info

Product

Resources

About