Oct, 2017
Kernel rootkits detection method by monitoring branches using hardware features
IEICE Transactions on Information and Systems
- ,
- Volume
- E100D
- Number
- 10
- First page
- 2377
- Last page
- 2381
- Language
- English
- Publishing type
- Research paper (international conference proceedings)
- DOI
- 10.1587/transinf.2016INL0003
- Publisher
- IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG
Copyright © 2017 The Institute of Electronics, Information and Communication Engineers. An operating system is an essential piece of software that manages hardware and software resources. Thus, attacks on an operating system kernel using kernel rootkits pose a particularly serious threat. Detecting an attack is difficult when the operating system kernel is infected with a kernel rootkit. For this reason, handling an attack will be delayed causing an increase in the amount of damage done to a computer system. In this paper, we propose Kernel Rootkits Guard (KRGuard), which is a new method to detect kernel rootkits that monitors branch records in the kernel space. Since many kernel rootkits make branches that differ from the usual branches in the kernel space, KRGuard can detect these differences by using the hardware features of commodity processors. Our evaluation shows that KRGuard can detect kernel rootkits that involve new branches in the system call handler processing with small overhead.
- Link information
-
- DOI
- https://doi.org/10.1587/transinf.2016INL0003
- DBLP
- https://dblp.uni-trier.de/rec/journals/ieicet/YamauchiA17
- Web of Science
- https://gateway.webofknowledge.com/gateway/Gateway.cgi?GWVersion=2&SrcAuth=JSTA_CEL&SrcApp=J_Gate_JST&DestLinkType=FullRecord&KeyUT=WOS:000417988600014&DestApp=WOS_CPL
- URL
- http://search.ieice.org/bin/summary.php?id=e100-d_10_2377
- URL
- https://dblp.uni-trier.de/db/journals/ieicet/ieicet100d.html#YamauchiA17
- Scopus
- https://www.scopus.com/inward/record.uri?partnerID=HzOxMe3b&scp=85030221594&origin=inward Open access
- Scopus Citedby
- https://www.scopus.com/inward/citedby.uri?partnerID=HzOxMe3b&scp=85030221594&origin=inward
- ID information
-
- DOI : 10.1587/transinf.2016INL0003
- ISSN : 0916-8532
- eISSN : 1745-1361
- DBLP ID : journals/ieicet/YamauchiA17
- SCOPUS ID : 85030221594
- Web of Science ID : WOS:000417988600014