Abstract:Linux servers are being used in almost all clouds, datacenters and supercomputers today. Linux Kernel functions are facing a kind of malware attacks, known as rootkits with root-access capability. The rootkits appear as loadable kernel modules (LKM) in today's Linux servers. These modules hide from other kernel objects, and can redirect the kernel control flow by tampering with the metadata needed in kernel service functions. The kernel rootkits are invisible to users after loading, which may bypass most security shields. Both spatial and temporal appearance of rootkits are randomly distributed, which makes it difficult to detect or removal. To deal with rootkit threats, we propose a novel Virtual Wall (VTW) approach to filtering out the rootkit-embedded LKMs by tracing the incurred kernel activities. This VTW is essentially a lightweight hypervisor built with rootkit detection and event tracing capabilities. Normally, the Linux runs in a guest mode. When a LKM execution violates the security policy set by the VTW, the OS control will switch to a host mode. The VTW at host mode enables the detection and tracing of rootkit events timely. In other words, potential rootkit attacks are detected, traced and classified to make meaningful filtering decisions. The whole detection and tracing process is based on memory access control and event injection mechanisms. Experimental results show that the VTW defense system is effective to detect and defend against kernel rootkits timely. The CPU overhead for executing VTW is less than 2 percent. Compared with other defense schemes (such as DIKernel, etc.), our vs is easier to implement with low performance degradation on Linux servers. We will demonstrate the advantages of VTW through its simplicity in implementation and potential performance gains. We will also compare our system with seven other rootkit defense systems.

Research on the Detection Technique of Bootkit

Defense of Hidden Backdoor Technology for Web

Analysis and Detection to Inserted Attacking Bootkit

RESEARCH AND IMPLEMENTATION OF DISK DATA ANALYSIS-BASED STATIC BOOTKIT DETECTION

A survey on the evolution of bootkits attack and defense techniques

Bootkit Detection Method Based on Disk Hidden PE File Searching

Design of detection system for BIOS Bootkit in Windows

Research of Rootkit Technology and Detection Method

Dynamic Rootkit Detection Methodology Based on Branch Instruction Analysis

A Methodology for Hook-Based Kernel Level Rootkits.

A New Methodology of Detecting System Level rootkit

Research and Implementation of the Module Binary Analysis for Rootkit Dectection

Research on Concealment Technology of Windows Rootkit

Synthetic approach for Windows Rootkit analysis and detection

Rootkit detection based on Kprobe

KVM-based Detection of Rootkit Attacks

Technology of Hidden Process Rootkit on Win32

Kernel-level Rootkit Detection, Prevention and Behavior Profiling: A Taxonomy and Survey

Anti-rootkit Technology of Kernel Integrity Detection and Restoration

Trojan Detection Using Its Auto-startup Characteristic

Virtual Wall: Filtering Rootkit Attacks to Protect Linux Kernel Functions.