Vigilare: toward snoop-based kernel integrity monitor

Authors:
Hyungon Moon;Hojoon Lee;Jihoon Lee;Kihwan Kim;Yunheung Paek;Brent Byunghoon Kang
Affiliations:
Seoul National University, Seoul, South Korea;Korea Advanced Institute of Science and Technology, Daejeon, South Korea;Seoul National University, Seoul, South Korea;Korea Advanced Institute of Science and Technology, Daejeon, South Korea;Seoul National University, Seoul, South Korea;George Mason University, Fairfax, VA, USA
Venue:
Proceedings of the 2012 ACM conference on Computer and communications security
Year:
2012

Citing 14
Cited 2

The SPARC architecture manual: version 8

The SPARC architecture manual: version 8
Terra: a virtual machine-based platform for trusted computing

SOSP '03 Proceedings of the nineteenth ACM symposium on Operating systems principles
Secure coprocessor-based intrusion detection

EW 10 Proceedings of the 10th workshop on ACM SIGOPS European workshop
A novel approach for a file-system integrity monitor tool of Xen virtual machine

ASIACCS '07 Proceedings of the 2nd ACM symposium on Information, computer and communications security
Copilot - a coprocessor-based kernel runtime integrity monitor

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
An architecture for specification-based detection of semantic integrity violations in kernel dynamic data

USENIX-SS'06 Proceedings of the 15th conference on USENIX Security Symposium - Volume 15
SecVisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity OSes

Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles
Automated detection of persistent kernel control-flow attacks

Proceedings of the 14th ACM conference on Computer and communications security
Automatic Inference and Enforcement of Kernel Data Structure Invariants

ACSAC '08 Proceedings of the 2008 Annual Computer Security Applications Conference
Soft-Timer Driven Transient Kernel Control Flow Attacks and Defense

ACSAC '08 Proceedings of the 2008 Annual Computer Security Applications Conference
Hardware Runtime Monitoring for Dependable COTS-Based Real-Time Embedded Systems

RTSS '08 Proceedings of the 2008 Real-Time Systems Symposium
Rootkits on smart phones: attacks, implications and opportunities

Proceedings of the Eleventh Workshop on Mobile Computing Systems & Applications
HyperSentry: enabling stealthy in-context measurement of hypervisor integrity

Proceedings of the 17th ACM conference on Computer and communications security
HyperCheck: a hardware-assisted integrity monitor

RAID'10 Proceedings of the 13th international conference on Recent advances in intrusion detection

CPU transparent protection of OS kernel and hypervisor integrity with programmable DRAM

Proceedings of the 40th Annual International Symposium on Computer Architecture
KI-Mon: a hardware-assisted event-triggered monitoring platform for mutable kernel object

SEC'13 Proceedings of the 22nd USENIX conference on Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this paper, we present Vigilare system, a kernel integrity monitor that is architected to snoop the bus traffic of the host system from a separate independent hardware. This snoop-based monitoring enabled by the Vigilare system, overcomes the limitations of the snapshot-based monitoring employed in previous kernel integrity monitoring solutions. Being based on inspecting snapshots collected over a certain interval, the previous hardware-based monitoring solutions cannot detect transient attacks that can occur in between snapshots. We implemented a prototype of the Vigilare system on Gaisler's grlib-based system-on-a-chip (SoC) by adding Snooper hardware connections module to the host system for bus snooping. To evaluate the benefit of snoop-based monitoring, we also implemented similar SoC with a snapshot-based monitor to be compared with. The Vigilare system detected all the transient attacks without performance degradation while the snapshot-based monitor could not detect all the attacks and induced considerable performance degradation as much as 10% in our tuned STREAM benchmark test.