Detecting Compromised Kernel Hooks with Support of Hardware Debugging Features

查看全文 作　　者：Shi [1,2]Wenchang;Zhou [1,2,3]HongWei;Yuan [3]JinHui;Liang [1,2]Bin

机构地区：[1]School of Information, Renmin University of China, Beijing 100872, P. R. China;[2]Key Laboratory of Data Engineering and Knowledge Engineering of Ministry of Education, Renmin University of China Beijing 100872, P. R. China;[3]Information Engineering University of China, Zhengzhou 450004, P. R. China

出　　处：《China Communications》索引2012年第9卷第10期,共13页

基　　金：The authors would like to thank the anonymous reviewers for their insightful corrnlents that have helped improve the presentation of this paper. The work was supported partially by the National Natural Science Foundation of China under Grants No. 61070192, No.91018008, No. 61170240; the National High-Tech Research Development Program of China under Grant No. 2007AA01ZA14; the Natural Science Foundation of Beijing un- der Grant No. 4122041. 摘　　要：Although there exist a few good schemes to protect the kernel hooks of operating systems, attackers are still able to circumvent existing defense mechanisms with spurious context information. To address this challenge, this paper proposes a framework, called HookIMA, to detect compromised kernel hooks by using hardware debugging features. The key contribution of the work is that context information is captured from hardware instead of from relatively vulnerable kernel data. Using commodity hardware, a proof-of-concept prototype system of HookIMA has been developed. This prototype handles 3 082 dynamic control-flow transfers with related hooks in the kernel space. Experiments show that HookIMA is capable of detecting compromised kernel hooks caused by kernel rootkits. Performance evaluations with UnixBench indicate that runtime overhead introduced by HookIMA is about 21.5%. 关键词：内核空间功能检测硬件调试调试功能挂钩原型系统操作系统防御机制

相关文献

参考文献（29）
引证文献（3）
耦合文献（0）

参考文献(29)

引证文献(3)

互联网出版许可证新出网证(渝)字10号全国400电话 - 免长途话费

Detecting Compromised Kernel Hooks with Support of Hardware Debugging Features

参考文献(29)

引证文献(3)

用户提示