Abstract:Linux servers are being used in almost all clouds, datacenters and supercomputers today. Linux Kernel functions are facing a kind of malware attacks, known as rootkits with root-access capability. The rootkits appear as loadable kernel modules (LKM) in today's Linux servers. These modules hide from other kernel objects, and can redirect the kernel control flow by tampering with the metadata needed in kernel service functions. The kernel rootkits are invisible to users after loading, which may bypass most security shields. Both spatial and temporal appearance of rootkits are randomly distributed, which makes it difficult to detect or removal. To deal with rootkit threats, we propose a novel Virtual Wall (VTW) approach to filtering out the rootkit-embedded LKMs by tracing the incurred kernel activities. This VTW is essentially a lightweight hypervisor built with rootkit detection and event tracing capabilities. Normally, the Linux runs in a guest mode. When a LKM execution violates the security policy set by the VTW, the OS control will switch to a host mode. The VTW at host mode enables the detection and tracing of rootkit events timely. In other words, potential rootkit attacks are detected, traced and classified to make meaningful filtering decisions. The whole detection and tracing process is based on memory access control and event injection mechanisms. Experimental results show that the VTW defense system is effective to detect and defend against kernel rootkits timely. The CPU overhead for executing VTW is less than 2 percent. Compared with other defense schemes (such as DIKernel, etc.), our vs is easier to implement with low performance degradation on Linux servers. We will demonstrate the advantages of VTW through its simplicity in implementation and potential performance gains. We will also compare our system with seven other rootkit defense systems.

Research on Concealment Technology of Windows Rootkit

Defense of Hidden Backdoor Technology for Web

Research of Rootkit Technology and Detection Method

Technology of Hidden Process Rootkit on Win32

Windows RootKit Technology and Protection Policy

Synthetic approach for Windows Rootkit analysis and detection

Research and Implementation of the Module Binary Analysis for Rootkit Dectection

Dynamic Rootkit Detection Methodology Based on Branch Instruction Analysis

Rootkit detection based on Kprobe

A New Methodology of Detecting System Level rootkit

Research on the Detection Technique of Bootkit

The Research of Information Hiding Technology Based on Portable Executable File Format

Anti-rootkit Technology of Kernel Integrity Detection and Restoration

A Methodology for Hook-Based Kernel Level Rootkits.

Study on Android Rootkit Based on VFS

Kernel-level Rootkit Detection, Prevention and Behavior Profiling: A Taxonomy and Survey

Bootkit Detection Method Based on Disk Hidden PE File Searching

An improved kernel Trojan horse architecture model

KVM-based Detection of Rootkit Attacks

Virtual Wall: Filtering Rootkit Attacks to Protect Linux Kernel Functions.

If It Looks Like a Rootkit and Deceives Like a Rootkit: A Critical Examination of Kernel-Level Anti-Cheat Systems