Detecting Kernel-Level Rootkits Using Data Structure Invariants

Baliga, Arati; Ganapathy, Vinod; Iftode, Liviu

doi:10.1109/tdsc.2010.38

Cited by 65 publications

(38 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Perhaps the most research work relevant to the proposed approach was presented in [31]. Gibraltar by Baliga et al takes advantage of data structure invariant inferences by generating a graph of kernel objects in memory and, then, derives constraints over the object data.…”

Section: Discussionmentioning

confidence: 99%

Evasion-resistant malware signature based on profiling kernel data structure objects

Shosha

Liu

Gladyshev

et al. 2012

2012 7th International Conference on Risks and Security of Internet and Systems (CRiSIS)

View full text Add to dashboard Cite

Abstract-Malware authors attempt in an endless effort to find new methods to evade the malware detection engines. A popular method is the use of obfuscation technologies that change the syntax of malicious code while preserving the execution semantics. This leads to the evasion of signatures that are built based on the code syntax. In this paper, we propose a novel approach to develop an evasion-resistant malware signature. This signature is based on the malware's execution profiles extracted from kernel data structure objects and neither uses malicious code syntax specific information code execution flow information. Thus, proposed signature is more resistant to obfuscation methods and resilient in detecting malicious code variants. To evaluate the effectiveness of the proposed approach, a prototype signature generation tool called SigGENE is developed. The effectiveness of signatures generated by SigGENE evaluated using an experimental root kit-simulation tool that employs techniques commonly found in rootkits. This simulationtool is obfuscated using several different methods. In further experiments, real-world malware samples that have different variants with the same behavior used to verify the real-world applicability of the approach. The experiments show that the proposed approach is effective, not only in generating a signature that detects the malware and its variants and defeats different obfuscation methods, but also, in producing an execution profiles that can be used to characterize different malicious attacks.

show abstract

Section: Discussionmentioning

confidence: 99%

Evasion-resistant malware signature based on profiling kernel data structure objects

Shosha

Liu

Gladyshev

et al. 2012

2012 7th International Conference on Risks and Security of Internet and Systems (CRiSIS)

View full text Add to dashboard Cite

show abstract

“…In study of research literature, one of the major methods of malware detection that has emerged over the years is Linux memory forensics [1] [2]. A number of authors have described novel detection systems using Memory Forensics, or using kernel data structure invariants as a reference frame to identify rootkit intrusions [3] [4]. The goal of this test technology is to facilitate threat assessment of malware, to understand its goals, and degrade impact on the compromised systems [5].…”

Section: Introductionmentioning

confidence: 99%

Virtual Memory Introspection Framework for Cyber Threat Detection in Virtual Environment

Upadhyay¹,

Gohel²,

Pons³

et al. 2018

Adv. sci. technol. eng. syst. j.

View full text Add to dashboard Cite

show abstract

“…The work in [5,6] is also used to detect kernel rootkits. The work in [5] monitors invariants in controlled flow transferring and constant relationships in data of uncontrolled flow.…”

Section: Introductionmentioning

confidence: 99%

“…The work in [5] monitors invariants in controlled flow transferring and constant relationships in data of uncontrolled flow. The work in [6] adopts the Daikon tool to deduce invariants from data structures which are extracted from memory pages and monitors these invariants to determine the state of kernels.…”

Section: Introductionmentioning

confidence: 99%

Study of Immune-Based Intrusion Detection Technology in Virtual Machines for Cloud Computing Environment

Ruirui¹,

Xin²

2017

Mobile Information Systems

View full text Add to dashboard Cite

Cloud computing platforms are usually based on virtual machines as the underlying architecture; the security of virtual machine systems is the core of cloud computing security. This paper presents an immune-based intrusion detection model in virtual machines of cloud computing environment, denoted as IB-IDS, to ensure the safety of user-level applications in client virtual machines. In the model, system call sequences and their parameters of processes are used, and environment information in the client virtual machines is extracted. Then the model simulates immune responses to ensure the state of user-level programs, which can detect attacks on the dynamic runtime of applications and has high real-time performance. There are five modules in the model: antigen presenting module, signal acquisition module, immune response module, signal measurement module, and information monitoring module, which are distributed into different levels of virtual machine environment. Performance analysis and experimental results show that the model brings a small performance overhead for the virtual machine system and has a good detection performance. It is applicable to judge the state of user-level application in guest virtual machine, and it is feasible to use it to increase the user-level security in software services of cloud computing platform.

show abstract

Detecting Kernel-Level Rootkits Using Data Structure Invariants

Cited by 65 publications

References 25 publications

Evasion-resistant malware signature based on profiling kernel data structure objects

Evasion-resistant malware signature based on profiling kernel data structure objects

Virtual Memory Introspection Framework for Cyber Threat Detection in Virtual Environment

Study of Immune-Based Intrusion Detection Technology in Virtual Machines for Cloud Computing Environment

Contact Info

Product

Resources

About