KI-Mon: a hardware-assisted event-triggered monitoring platform for mutable kernel object

Authors:
Hojoon Lee;Hyungon Moon;Daehee Jang;Kihwan Kim;Jihoon Lee;Yunheung Paek;Brent ByungHoon Kang
Affiliations:
Graduate School of Information Security, KAIST;Department of Electrical and Computer Engineering, Seoul National University;Graduate School of Information Security, KAIST;Graduate School of Information Security, KAIST;Department of Electrical and Computer Engineering, Seoul National University;Department of Electrical and Computer Engineering, Seoul National University;Graduate School of Information Security, KAIST
Venue:
SEC'13 Proceedings of the 22nd USENIX conference on Security
Year:
2013

Citing 22
Cited 0

Understanding the Linux Kernel, Second Edition

Understanding the Linux Kernel, Second Edition
Control-flow integrity

Proceedings of the 12th ACM conference on Computer and communications security
Secure coprocessor-based intrusion detection

EW 10 Proceedings of the 10th workshop on ACM SIGOPS European workshop
Copilot - a coprocessor-based kernel runtime integrity monitor

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
An architecture for specification-based detection of semantic integrity violations in kernel dynamic data

USENIX-SS'06 Proceedings of the 15th conference on USENIX Security Symposium - Volume 15
SecVisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity OSes

Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles
Automated detection of persistent kernel control-flow attacks

Proceedings of the 14th ACM conference on Computer and communications security
Lares: An Architecture for Secure Active Monitoring Using Virtualization

SP '08 Proceedings of the 2008 IEEE Symposium on Security and Privacy
Countering Persistent Kernel Rootkits through Systematic Hook Discovery

RAID '08 Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection
Ether: malware analysis via hardware virtualization extensions

Proceedings of the 15th ACM conference on Computer and communications security
Automatic Inference and Enforcement of Kernel Data Structure Invariants

ACSAC '08 Proceedings of the 2008 Annual Computer Security Applications Conference
Secure in-VM monitoring using hardware virtualization

Proceedings of the 16th ACM conference on Computer and communications security
Mapping kernel objects to enable systematic integrity checking

Proceedings of the 16th ACM conference on Computer and communications security
HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity

SP '10 Proceedings of the 2010 IEEE Symposium on Security and Privacy
Linux Kernel Development

Linux Kernel Development
HyperSentry: enabling stealthy in-context measurement of hypervisor integrity

Proceedings of the 17th ACM conference on Computer and communications security
HyperCheck: a hardware-assisted integrity monitor

RAID'10 Proceedings of the 13th international conference on Recent advances in intrusion detection
Kernel malware analysis with un-tampered and temporal views of dynamic kernel memory

RAID'10 Proceedings of the 13th international conference on Recent advances in intrusion detection
DKSM: Subverting Virtual Machine Introspection for Fun and Profit

SRDS '10 Proceedings of the 2010 29th IEEE Symposium on Reliable Distributed Systems
Ensuring operating system kernel integrity with OSck

Proceedings of the sixteenth international conference on Architectural support for programming languages and operating systems
Detecting Kernel-Level Rootkits Using Data Structure Invariants

IEEE Transactions on Dependable and Secure Computing
Vigilare: toward snoop-based kernel integrity monitor

Proceedings of the 2012 ACM conference on Computer and communications security

Quantified Score

Hi-index	0.00

Visualization

Abstract

Kernel rootkits undermine the integrity of system by manipulating its operating system kernel. External hardware-based monitors can serve as a root of trust that is resilient to rootkit attacks. The existing external hardware-based approaches lack an event-triggered verification scheme for mutable kernel objects. To address the issue, we present KI-Mon, a hardware-based platform for event-triggered kernel integrity monitor. A refined form of bus traffic monitoring efficiently verifies the update values of the objects, and callback verification routines can be programmed and executed for a designated event space. We have built a KI-Mon prototype to demonstrate the efficacy of KI-Mon's event-triggered mechanism in terms of performance overhead for the monitored host system and the processor usage of the KI-Mon processor.