.png){kind=icon}
返回
Detecting Kernel-Level Rootkits Using Data Structure Invariants
.png){kind=icon}
PRE
AI
DOI：10.1109/TDSC.2010.38.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Rootkits affect system security by modifying kernel data structures to achieve a variety of malicious goals. While early rootkits modified control data structures, such as the system call table and values of function pointers, recent work has demonstrated rootkits that maliciously modify noncontrol data. Most prior techniques for rootkit detection have focused solely on detecting control data modifications and, therefore, fail to detect such rootkits. This paper presents a novel technique to detect rootkits that modify both control and noncontrol data. The main idea is to externally observe the execution of the kernel during an inference phase and hypothesize invariants on kernel data structures. A rootkit detection phase uses these invariants as specifications of data structure integrity. During this phase, violation of invariants indicates an infection. We have implemented Gibraltar, a prototype tool that infers kernel data structure invariants and uses them to detect rootkits. Experiments show that Gibraltar can effectively detect previously known rootkits, including those that modify noncontrol data structures.
Keyword:
Kernel-level rootkits
noncontrol data attacks
invariant inference
static and dynamic program analysis
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
7.5
论文数:
2.4K
被引数:
9.6K
机构
引用论文
.png){kind=icon}
Lesion homogeneity on diffusion-weighted imaging is a marker of outcome in acute ischemic stroke
OAAI
OAAI分享收藏分享收藏
查看更多内容