DMCA
Detecting kernel-level rootkits using data structure invariants
| Venue: | IEEE TDSC |
| Citations: | 18 - 8 self |
BibTeX
@ARTICLE{Baliga_detectingkernel-level,
author = {Arati Baliga and Vinod Ganapathy and Liviu Iftode},
title = {Detecting kernel-level rootkits using data structure invariants},
journal = {IEEE TDSC},
year = {},
pages = {2011}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract—Rootkits affect system security by modifying kernel data structures to achieve a variety of malicious goals. While early rootkits modified control data structures, such as the system call table and values of function pointers, recent work has demonstrated rootkits that maliciously modify non-control data. Most prior techniques for rootkit detection have focused solely on detecting control data modifications and, therefore, fail to detect such rootkits. This article presents a novel technique to detect rootkits that modify both control and non-control data. The main idea is to externally observe the execution of the kernel during an inference phase and hypothesize invariants on kernel data structures. A rootkit detection phase uses these invariants as specifications of data structure integrity. During this phase, violation of invariants indicates an infection. We have implemented Gibraltar, a prototype tool that infers kernel data structure invariants and uses them to detect rootkits. Experiments show that Gibraltar can effectively detect previously-known rootkits, including those that modify non-control data structures. Index Terms—Kernel-level rootkits, non-control data attacks, invariant inference, static and dynamic program analysis. 1
Keyphrases
data structure invariant kernel-level rootkits non-control data kernel data structure previously-known rootkits novel technique non-control data structure recent work function pointer rootkit detection index term kernel-level rootkits invariant inference system call table prior technique non-control data attack dynamic program analysis rootkit detection phase early rootkits main idea prototype tool abstract rootkits affect system security control data modification inference phase malicious goal control data structure data structure integrity
