Abstract:Linux servers are being used in almost all clouds, datacenters and supercomputers today. Linux Kernel functions are facing a kind of malware attacks, known as rootkits with root-access capability. The rootkits appear as loadable kernel modules (LKM) in today's Linux servers. These modules hide from other kernel objects, and can redirect the kernel control flow by tampering with the metadata needed in kernel service functions. The kernel rootkits are invisible to users after loading, which may bypass most security shields. Both spatial and temporal appearance of rootkits are randomly distributed, which makes it difficult to detect or removal. To deal with rootkit threats, we propose a novel Virtual Wall (VTW) approach to filtering out the rootkit-embedded LKMs by tracing the incurred kernel activities. This VTW is essentially a lightweight hypervisor built with rootkit detection and event tracing capabilities. Normally, the Linux runs in a guest mode. When a LKM execution violates the security policy set by the VTW, the OS control will switch to a host mode. The VTW at host mode enables the detection and tracing of rootkit events timely. In other words, potential rootkit attacks are detected, traced and classified to make meaningful filtering decisions. The whole detection and tracing process is based on memory access control and event injection mechanisms. Experimental results show that the VTW defense system is effective to detect and defend against kernel rootkits timely. The CPU overhead for executing VTW is less than 2 percent. Compared with other defense schemes (such as DIKernel, etc.), our vs is easier to implement with low performance degradation on Linux servers. We will demonstrate the advantages of VTW through its simplicity in implementation and potential performance gains. We will also compare our system with seven other rootkit defense systems.

Research of Rootkit Technology and Detection Method

Defense of Hidden Backdoor Technology for Web

Research on Concealment Technology of Windows Rootkit

Technology of Hidden Process Rootkit on Win32

Research and Implementation of the Module Binary Analysis for Rootkit Dectection

Dynamic Rootkit Detection Methodology Based on Branch Instruction Analysis

KVM-based Detection of Rootkit Attacks

A New Methodology of Detecting System Level rootkit

Research on the Detection Technique of Bootkit

Kernel-level Rootkit Detection, Prevention and Behavior Profiling: A Taxonomy and Survey

Synthetic approach for Windows Rootkit analysis and detection

Windows RootKit Technology and Protection Policy

Research and Development of Worm Detection Technologies

Rootkit detection based on Kprobe

Anti-rootkit Technology of Kernel Integrity Detection and Restoration

A Methodology for Hook-Based Kernel Level Rootkits.

Virtual Wall: Filtering Rootkit Attacks to Protect Linux Kernel Functions.

Study on Android Rootkit Based on VFS

Virus Analysis on IDT Hooks of Rootkits Trojan

Detection of Trojan Covert Communication Based on Client Honeypot

Automatic Detection and Protection System to Ensure Kernel Integrity