LSM-Based Secure System Monitoring Using Kernel Protection Schemes

Abstract

Monitoring a process and its file I/O behaviors is important for security inspection for a data center server against intrusions, malware infection and information leakage. In the case of the Linux kernel 2.6, a set of hook functions called the Linux Security Module (LSM) has been implemented in order to monitor and control the system calls. By using the LSM we can inspect the activity of unknown malicious processes. However, a sophisticated attacker could breach the kernel configurations using the rootkits. Furthermore since the monitoring results of the malicious process activity are stored as a file on Hard Disk Drive (HDD), it will be easily manipulated by the attacker. In this paper, we propose a secure monitoring scheme that addresses the attacks against the monitoring module and its result for security inspection of the data center server. The monitoring module is implemented as a LSM-based function and protected by the kernel protection technique. The integrity of the monitoring result is guaranteed by using a Mandatory Access Control (MAC) of the Linux kernel and a mechanism of the trusted process invocation. This mechanism can serve as an infrastrucuture of secure inspection platform for data center server because the integrity of the monitoring module and its result is guaranteed.

Mathematical modeling of damage function when attacking file server

“…Knowledge of the distribution law makes it possible to estimate possible deviations in the value of damage from its mean value. However, in practice, the distribution law of the damage extent is not usually applied [2][3][4]. Contemporary science has not developed clear algorithms for a priori specification of the distribution law of a random variable.…”

VMBLS: Virtual Machine Based Logging Scheme for Prevention of Tampering and Loss

“…An original logging method, independent of syslog, has been proposed for audit [8]. This method uses Linux Security Modules (LSM) to gather the logs, and Mandatory Access Control (MAC) to ensure their validity.…”

“…This is a scientific method or research technology for court actions, which allows us to explain the validity of the electronic records. Many researchers are working in this area of the protection of logging information [2,4,8,10,11].…”

Virtualization Security Combining Mandatory Access Control and Virtual Machine Introspection

“…LSM is also used in MAC-based malware and rootkit detection solution in [12]. The process information is obtained by using LSM to intercept the system calls which are activated when a process is executed.…”