X-TIER: Kernel Module Injection

Vogl, Sebastian; Kılıç, Fatih; Schneider, Christian; Eckert, Claudia

doi:10.1007/978-3-642-38631-2_15

Cited by 9 publications

(2 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Process implanting (PI) [12], kernel-module injection (X-TIER) [34] and process hijacking (SYRINGE) [7] have been proposed in prior art as methods to perform introspection into the state of virtual machines. For such introspection to be secure, extra protection needs to be provided by the hypervisor to deny the runtime modification of the stack and heap data of the implanted code.…”

Section: Related Workmentioning

confidence: 99%

Scalability, fidelity and stealth in the DRAKVUF dynamic malware analysis system

Lengyel¹,

Maresca²,

Payne³

et al. 2014

Proceedings of the 30th Annual Computer Security Applications Conference

Self Cite

147

View full text Add to dashboard Cite

Malware is one of the biggest security threats on the Internet today and deploying effective defensive solutions requires the rapid analysis of a continuously increasing number of malware samples. With the proliferation of metamorphic malware the analysis is further complicated as the efficacy of signature-based static analysis systems is greatly reduced. While dynamic malware analysis is an effective alternative, the approach faces significant challenges as the ever increasing number of samples requiring analysis places a burden on hardware resources. At the same time modern malware can both detect the monitoring environment and hide in unmonitored corners of the system.In this paper we present DRAKVUF, a novel dynamic malware analysis system designed to address these challenges by building on the latest hardware virtualization extensions and the Xen hypervisor. We present a technique for improving stealth by initiating the execution of malware samples without leaving any trace in the analysis machine. We also present novel techniques to eliminate blind-spots created by kernel-mode rootkits by extending the scope of monitoring to include kernel internal functions, and to monitor file-system accesses through the kernel's heap allocations. With extensive tests performed on recent malware samples we show that DRAKVUF achieves significant improvements in conserving hardware resources while providing a stealthy, in-depth view into the behavior of modern malware.

show abstract

Section: Related Workmentioning

confidence: 99%

Scalability, fidelity and stealth in the DRAKVUF dynamic malware analysis system

Lengyel¹,

Maresca²,

Payne³

et al. 2014

Proceedings of the 30th Annual Computer Security Applications Conference

Self Cite

147

View full text Add to dashboard Cite

show abstract

“…Unlike the time point-based detection method, the periodbased detection method extends single detection to periodic detection. Such as X-TIER [9] proposed by Sebastian, it injects and removes a kernel module into TVM periodically. The injected module reads some kernel data structures to get TVM view.…”

Section: Related Workmentioning

confidence: 99%

RMVP: A Real-Time Method to Monitor Random Processes of Virtual Machine

Yun

Cui

et al. 2019

IEEE Access

View full text Add to dashboard Cite

Out-of-box methods can provide strict isolation between the security tool and the target virtual machine (TVM), so they have strong anti-jamming abilities. Current monitoring methods are mostly based on memory snapshots at a time point or a fixed period. Due to the randomness of processes and the discontinuity of monitoring methods, methods based on time point or fixed period snapshots that security tools used to monitor processes may result in a high leakage rate. The real-time monitoring method can be used to resolve this problem. However, all current real-time monitoring methods require a ready monitoring set, and their monitoring range is strictly limited. They are only effective for the inherent objects within the ready set and ineffective for the random processes. This paper presents real-time monitoring of virtual machine processes (RMVP), a real-time monitoring method to monitor a random process in the TVM. First, the RMVP monitors process switch by capturing the switch of kernel stack base addresses outside the TVM in real time. Then, it extracts raw memory of the current process through the memory mapping technology that adopts caching mechanism and multi-task concurrent execution strategy. Finally, the RMVP translates raw memory into high-level semantics according to a semantic knowledge base constructed offline. The RMVP can monitor random processes in real time and overcome the challenge of process randomness. The experimental results show that the capture rate of the random process is over 95% and the capture delay is in the range of 2.3∼3.3 ms. In addition, the RMVP is especially effective for detecting the processes hidden by rootkits. INDEX TERMS Virtual machine, real-time monitoring, process detection, rootkit, memory mapping.

show abstract