Bridging the Semantic Gap to Mitigate Kernel-Level Keyloggers

Abstract

Kernel-level keyloggers, which are installed as part of the operating system (OS) with complete control of kernel code, data and resources, are a growing and very serious threat to the security of current systems. Defending against this type of malware means defending the kernel itself against compromise and it is still an open and difficult problem. This paper details the implementation of two classical kernel-level keyloggers for Linux 2.6.38 and how current defense approaches still fail to protect OSes against this type of malware. We further present our current research directions to mitigate this threat by employing an architecture where a guest OS and a virtual machine layer actively collaborate to guarantee kernel integrity. This collaborative approach allows us to better bridge the semantic gap between the OS and architecture layers and devise stronger and more flexible defense solutions to protect the integrity of OS kernels.

An Innovative Keylogger Detection System Using Machine Learning Algorithms and Dendritic Cell Algorithm

“…The negatives include the need for real-time DOS attack detection as well as the need to examine the effects of changing K-value and DCA lifespan on performance. Navarro et al [12] discussed kernel-level keyloggers. Keyloggers that operate at the kernel level represent an imminent threat to the security of current systems.…”

Mouse Underlaying: Global Key and Mouse Listener Based on an Almost Invisible Window with Local Listeners and Sophisticated Focus

“…Figure 1 depicts how the the keylogger is installing a Keyboard Filter Driver before the system's keyboard device driver takes effect [12]. In order to install this filter driver administrator privileges are required [17]. In the following, this filter driver captures keystrokes of the user and relays them by cloning.…”

“…Afterwards, the moveWindow_thread will be paused 16 . Now the keylogger window moves to a different position in the vicinity of the mouse pointer 17 . After a short waiting time, the pressed mouse button state will be imitated 18 .…”

“…For installing an additional element applied by conventional keylogging methods, kernel modification (driver installation) or changes in the configuration file of the operation system (hook registration and thread attaching) are required [17]. As a consequence, antivirus programs will report this action to the user.…”