利用硬件调试特性检测内核异常hook的方法(英文)

被引：3

作者：

石文昌 ^{[1
,2
]}

周洪伟 ^{[1
,2
,3
]}

原锦辉 ^{[3
]}

梁彬 ^{[1
,2
]}

机构：

[1] School of Information, Renmin University of China

[2] Key Laboratory of Data Engineering and Knowledge Engineering of Ministry of Education, Renmin University of China

[3] Information Engineering University of

来源：

中国通信 | 2012年 / 9卷 / 10期

关键词：

operating system; kernel hook; integrity; hardware; control flow;

D O I：

暂无

中图分类号：

TP306.2 [];

学科分类号：

摘要：

Although there exist a few good schemes to protect the kernel hooks of operating systems, attackers are still able to circumvent existing defense mechanisms with spurious context information. To address this challenge, this paper proposes a framework, called HookIMA, to detect compromised kernel hooks by using hardware debugging features. The key contribution of the work is that context information is captured from hardware instead of from relatively vulnerable kernel data. Using commodity hardware, a proof-of-concept prototype system of HookIMA has been developed. This prototype handles 3 082 dynamic control-flow transfers with related hooks in the kernel space. Experiments show that HookIMA is capable of detecting compromised kernel hooks caused by kernel rootkits. Performance evaluations with UnixBench indicate that runtime overhead introduced by HookIMA is about 21.5%.

引用

页码：78 / 90

页数：13