IEICE TRANSACTIONS on Information
Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features
Summary :
An operating system is an essential piece of software that manages hardware and software resources. Thus, attacks on an operating system kernel using kernel rootkits pose a particularly serious threat. Detecting an attack is difficult when the operating system kernel is infected with a kernel rootkit. For this reason, handling an attack will be delayed causing an increase in the amount of damage done to a computer system. In this paper, we propose Kernel Rootkits Guard (KRGuard), which is a new method to detect kernel rootkits that monitors branch records in the kernel space. Since many kernel rootkits make branches that differ from the usual branches in the kernel space, KRGuard can detect these differences by using the hardware features of commodity processors. Our evaluation shows that KRGuard can detect kernel rootkits that involve new branches in the system call handler processing with small overhead.
- Publication
- IEICE TRANSACTIONS on Information Vol.E100-D No.10 pp.2377-2381
- Publication Date
- 2017/10/01
- Publicized
- 2017/07/21
- Online ISSN
- 1745-1361
- DOI
- 10.1587/transinf.2016INL0003
- Type of Manuscript
- Special Section LETTER (Special Section on Security, Privacy and Anonymity in Computation, Communication and Storage Systems)
- Category
Authors
Toshihiro YAMAUCHI
Okayama University
Yohei AKAO
Okayama University
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Toshihiro YAMAUCHI, Yohei AKAO, "Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features" in IEICE TRANSACTIONS on Information,
vol. E100-D, no. 10, pp. 2377-2381, October 2017, doi: 10.1587/transinf.2016INL0003.
Abstract: An operating system is an essential piece of software that manages hardware and software resources. Thus, attacks on an operating system kernel using kernel rootkits pose a particularly serious threat. Detecting an attack is difficult when the operating system kernel is infected with a kernel rootkit. For this reason, handling an attack will be delayed causing an increase in the amount of damage done to a computer system. In this paper, we propose Kernel Rootkits Guard (KRGuard), which is a new method to detect kernel rootkits that monitors branch records in the kernel space. Since many kernel rootkits make branches that differ from the usual branches in the kernel space, KRGuard can detect these differences by using the hardware features of commodity processors. Our evaluation shows that KRGuard can detect kernel rootkits that involve new branches in the system call handler processing with small overhead.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.2016INL0003/_p
Copy
@ARTICLE{e100-d_10_2377,
author={Toshihiro YAMAUCHI, Yohei AKAO, },
journal={IEICE TRANSACTIONS on Information},
title={Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features},
year={2017},
volume={E100-D},
number={10},
pages={2377-2381},
abstract={An operating system is an essential piece of software that manages hardware and software resources. Thus, attacks on an operating system kernel using kernel rootkits pose a particularly serious threat. Detecting an attack is difficult when the operating system kernel is infected with a kernel rootkit. For this reason, handling an attack will be delayed causing an increase in the amount of damage done to a computer system. In this paper, we propose Kernel Rootkits Guard (KRGuard), which is a new method to detect kernel rootkits that monitors branch records in the kernel space. Since many kernel rootkits make branches that differ from the usual branches in the kernel space, KRGuard can detect these differences by using the hardware features of commodity processors. Our evaluation shows that KRGuard can detect kernel rootkits that involve new branches in the system call handler processing with small overhead.},
keywords={},
doi={10.1587/transinf.2016INL0003},
ISSN={1745-1361},
month={October},}
Copy
TY - JOUR
TI - Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features
T2 - IEICE TRANSACTIONS on Information
SP - 2377
EP - 2381
AU - Toshihiro YAMAUCHI
AU - Yohei AKAO
PY - 2017
DO - 10.1587/transinf.2016INL0003
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E100-D
IS - 10
JA - IEICE TRANSACTIONS on Information
Y1 - October 2017
AB - An operating system is an essential piece of software that manages hardware and software resources. Thus, attacks on an operating system kernel using kernel rootkits pose a particularly serious threat. Detecting an attack is difficult when the operating system kernel is infected with a kernel rootkit. For this reason, handling an attack will be delayed causing an increase in the amount of damage done to a computer system. In this paper, we propose Kernel Rootkits Guard (KRGuard), which is a new method to detect kernel rootkits that monitors branch records in the kernel space. Since many kernel rootkits make branches that differ from the usual branches in the kernel space, KRGuard can detect these differences by using the hardware features of commodity processors. Our evaluation shows that KRGuard can detect kernel rootkits that involve new branches in the system call handler processing with small overhead.
ER -
English
