.png){kind=icon}
Return
HYPERSEC: An Extensible Hypervisor-Assisted Framework for Kernel Rootkit Detection
.png){kind=icon}
PRE
AI
DOI：10.1007/978-3-032-08124-7_25.png)
.png){kind=icon}
.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Modern Endpoint Detection and Reaction (EDR) systems must remain reliable even when attackers acquire high privileges within the monitored operating system. Ideally, such systems should be protected from compromise, while maintaining deep visibility into the internal behavior of the target system. To meet this challenge, we aim to isolate the monitored system in a virtual machine (VM) and move the EDR logic into the hypervisor. We present HyperSec, a domain-specific language that allows the VM to safely delegate detection logic to the hypervisor by transmitting specialized monitoring programs. This design bridges the semantic gap by enabling the hypervisor to understand OS-level structures, while constraining accepted programs to protect the hypervisor against potential vulnerabilities. We evaluated our system against kernel rootkits that hide processes or elevate privileges and showed that HyperSec enables reliable detection of such threats. Our results indicate that the performance overhead remains acceptable, paving the way for broader adoption of hypervisor-based EDR with custom in-VM insight.
Keywords:
Security
Hypervisor
Intrusion Detection Systems
Rootkit
Journal
I
IF:
0
Papers:
26
Citations:
1
Organization
Cited Papers
Embedded Hypervisor Xvisor: A Comparative Analysis.png)
2015 23rd Euromicro International Conference on Parallel, Distributed, and Network-Based Processing
2015 23rd Euromicro International Conference on Parallel, Distributed, and Network-Based ProcessingIF0
PREAI
ShareSaveThe Hidden Threat: Analysis of Linux Rootkit Techniques and Limitations of Current Detection Tools
IF0
PREAI
ShareSaveShareSaveShareSaveShareSaveShareSave
View more