Implicit Detection of Hidden Processes with a Feather-Weight Hardware-Assisted Virtual Machine Monitor

  • Authors:

  • Yan Wen;Jinjing Zhao;Huaimin Wang;Jiannong Cao

  • Affiliations:

  • School of Computer, National University of Defense Technology, Changsha, China;Beijing Institute of System Engineering, Beijing, China;School of Computer, National University of Defense Technology, Changsha, China;Department of Computing, Hong Kong Polytechnic University, Kowloon, Hong Kong, China

  • Venue:
  • ACISP '08 Proceedings of the 13th Australasian conference on Information Security and Privacy
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

Process hiding is a commonly used stealth technique which facilitates the evasion from the detection by anti-malware programs. In this paper, we propose a new approach called Ariesto implicitly detect the hidden processes. Aries introduces a novel feather-weight hardware-assisted virtual machine monitor (VMM) to obtain the True Process List (TPL). Compared to existing VMM-based approaches, Aries offers three distinct advantages: dynamic OS migration, implicit introspection of TPLand non-bypassable interfacesfor exposing TPL. Unlike typical VMMs, Aries can dynamically migrate a booted OS on it. By tracking the low-level interactions between the OS and the memory management structures, Aries is decoupled with the explicit OS implementation information which is subvertable for the privileged malware. Our functionality evaluation shows Aries can detect more process-hiding malware than existing detectors while the performance evaluation shows desktop-oriented workloads achieve 95.2% of native speed on average.