.png){kind=icon}
返回
Toward a general defense against kernel queue hooking attacks
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2011.12.007.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Kernel queue hooking (KQH) attacks achieve stealthy malicious function execution by embedding malicious hooks in dynamic kernel schedulable queues (K-Queues). Because they keep kernel code and persistent hooks intact, they can evade detection of state-of-the-art kernel integrity monitors. Moreover, they have been used by advanced malware such as the Rustock spam bot to achieve malicious goals. In this paper, we present a systematic defense against such novel attacks. We propose the Precise Lookahead Checking of function Pointers approach that checks the legitimacy of pending K-Queue callback requests by proactively checking function pointers that may be invoked by the callback function. To facilitate the derivation of specifications for any K-Queue, we build a unified static analysis framework and a toolset that can derive from kernel source code properties of legitimate K-Queue requests and turn them into source code for the runtime checker. We implement proof-of-concept runtime checkers for four K-Queues in Linux and perform a comprehensive experimental evaluation of these checkers, which shows that our defense is effective against KQH attacks. (c) 2011 Published by Elsevier Ltd.
Keyword:
Control flow integrity
Kernel queue hooking
Rootkits
Runtime defense
Static analysis
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
In vitro evaluation of the cellular effect of indium tin oxide nanoparticles using the human lung adenocarcinoma A549 cells.png)
Metallomics
OAAI
MetallomicsIF0
OAAI分享收藏
查看更多内容