.png){kind=icon}
Return
A Kernel Rootkit Detection Approach Based on Virtualization and Machine Learning
.png){kind=icon}
OA
AI
DOI：10.1109/ACCESS.2019.2928060.png)
.png){kind=icon}
.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
OS kernel is the core part of the operating system, and it plays an important role for OS resource management. A popular way to compromise OS kernel is through a kernel rootkit (i.e., malicious kernel module). Once a rootkit is loaded into the kernel space, it can carry out arbitrary malicious operations with high privilege. To defeat kernel rootkits, many approaches have been proposed in the past few years. However, existing methods suffer from some limitations: 1) most methods focus on user-mode rootkit detection; 2) some methods are limited to detect obfuscated kernel modules; and 3) some methods introduce significant performance overhead. To address these problems, we propose VKRD, a kernel rootkit detection system based on the hardware assisted virtualization technology. Compared with previous methods, VKRD can provide a transparent and an efficient execution environment for the target kernel module to reveal its run-time behavior. To select the important run-time features for training our detection models, we utilize the TF-IDF method. By combining the hardware assisted virtualization and machine learning techniques, our kernel rootkit detection solution could be potentially applied in the cloud environment. The experiments show that our system can detect windows kernel rootkits with high accuracy and moderate performance cost.
Keywords:
OS
kernel rootkit
virtualization
machine learning
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
IF:
3.6
Papers:
9.8W
Citations:
29.4W
Organization
Cited Papers
ShareSavePartial purification and characterization of a lipolytic enzyme from spores of the arbuscular mycorrhizal fungusGlomus versiforme.png)
Mycologia
MycologiaIF0
PREAI
ShareSaveShareSaveStructural Changes in Lumirhodopsin and Metarhodopsin I Studied by Their Photoreactions at 77 KBiochemistry
BiochemistryIF0
PREAI
ShareSaveIn vitro evaluation of the cellular effect of indium tin oxide nanoparticles using the human lung adenocarcinoma A549 cellsMetallomicsOAAI
MetallomicsIF0
OAAIShareSaveShareSave
View more