Jan 6, 2016
Proposal of Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features
Proceedings - 2015 IIAI 4th International Congress on Advanced Applied Informatics, IIAI-AAI 2015
- ,
- First page
- 721
- Last page
- 722
- Language
- English
- Publishing type
- Research paper (international conference proceedings)
- DOI
- 10.1109/IIAI-AAI.2015.243
- Publisher
- IEEE
© 2015 IEEE. Attacks on computer systems have become more frequent in recent years. Attacks using kernel root kits pose a particularly serious threat. When a computer system is infected with a kernel root kit, attack detection is difficult. Because of this, handling the attack will be delayed causing an increase in the amount of damage done to the computer system. This paper proposes a new method to detect kernel root kits by monitoring the branch records in kernel space using hardware features of commodity processors. Our method utilizes the fact that many kernel root kits make branches that differ from the usual branches. By introducing our method, it is possible to detect kernel root kits immediately and, thereby, reduce damages to a minimum.
- Link information
-
- DOI
- https://doi.org/10.1109/IIAI-AAI.2015.243
- DBLP
- https://dblp.uni-trier.de/rec/conf/iiaiaai/AkaoY15
- Web of Science
- https://gateway.webofknowledge.com/gateway/Gateway.cgi?GWVersion=2&SrcAuth=JSTA_CEL&SrcApp=J_Gate_JST&DestLinkType=FullRecord&KeyUT=WOS:000380532300141&DestApp=WOS_CPL
- URL
- https://dblp.uni-trier.de/conf/iiaiaai/2015
- URL
- https://dblp.uni-trier.de/db/conf/iiaiaai/iiaiaai2015.html#AkaoY15
- Scopus
- https://www.scopus.com/inward/record.uri?partnerID=HzOxMe3b&scp=84964344462&origin=inward
- Scopus Citedby
- https://www.scopus.com/inward/citedby.uri?partnerID=HzOxMe3b&scp=84964344462&origin=inward
- ID information
-
- DOI : 10.1109/IIAI-AAI.2015.243
- ISBN : 9781479999576
- ISBN : 9781479999583
- DBLP ID : conf/iiaiaai/AkaoY15
- SCOPUS ID : 84964344462
- Web of Science ID : WOS:000380532300141