Abstract:Run-time behavior of processes – running on an end-host – is being actively used to dynamically detect malware. Most of these detection schemes build model of run-time behavior of a process on the basis of its data flow and/or sequence of system calls. These novel techniques have shown promising results but an efficient and effective technique must meet the following performance metrics: (1) high detection accuracy, (2) low false alarm rate, (3) small detection time, and (4) the technique should be resilient to run-time evasion attempts.To meet these challenges, a novel concept of genetic footprint is proposed, by mining the information in the kernel process control blocks (PCB) of a process, that can be used to detect malicious processes at run time. The genetic footprint consists of selected parameters – maintained inside the PCB of a kernel for each running process – that define the semantics and behavior of an executing process. A systematic forensic study of the execution traces of benign and malware processes is performed to identify discriminatory parameters of a PCB (task_struct is PCB in case of Linux OS). As a result, 16 out of 118 task structure parameters are short listed using the time series analysis. A statistical analysis is done to corroborate the features of the genetic footprint and to select suitable machine learning classifiers to detect malware.The scheme has been evaluated on a dataset that consists of 105 benign processes and 114 recently collected malware processes for Linux. The results of experiments show that the presented scheme achieves a detection accuracy of 96% with 0% false alarm rate in less than 100ms of the start of a malicious activity. Last but not least, the presented technique utilizes partial knowledge that is available at a given time while the process is still executing; as a result, the kernel of OS can devise mitigation strategies. It is also shown that the presented technique is robust to well known run-time evasion attempts.

Research on using kernel dynamic tracking to locate system bug

THE IMPLEMENTATION OF FAULTS DEBUGGING AND DETECTION BASED ON VXWORKS

Different is Good

Static Information Flow Tracking Based Approach to Detect Input Validation Vulnerabilities

When Top-down Meets Bottom-up: Detecting and Exploiting Use-After-Cleanup Bugs in Linux Kernel

Kernel Refcount Bug Detection Based on the Consistency of Error Path Behavior

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

KIT: Testing OS-Level Virtualization for Functional Interference Bugs

Instant Bug Testing Service For Linux Kernel

KALD : Detecting Direct Pointer Disclosure Vulnerabilities

In-execution dynamic malware analysis and detection by mining information in process control blocks of Linux OS

How about Bug-Triggering Paths? - Understanding and Characterizing Learning-Based Vulnerability Detectors

Automatic Detection and Protection System to Ensure Kernel Integrity

Based on the FUZZING Lead to a New Mining Method Based on Windows Kernel Vulnerability

Kernel data race detection using debug register in Linux

Detecting Kernel Refcount Bugs with Two-Dimensional Consistency Checking

Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers

Integrity Checking of Function Pointers in Kernel Pools via Virtual Machine Introspection

UBITect: a precise and scalable method to detect use-before-initialization bugs in Linux kernel

Vulnerability Detection System Based on Taint Range Propagation Analysis

Survey of OS Kernel Fuzzing