KRGuard: Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features

Abstract

Attacks on an operating system kernel using kernel rootkits pose a particularly serious threat. Detecting an attack is difficult when the operating system kernel is infected with a kernel rootkit. For this reason, handling an attack will be delayed causing an increase in the amount of damage done to a computer system. In this paper, we discuss KRGuard (Kernel Rootkits Guard), which is a new method to detect kernel rootkits that monitors branch records in the kernel space. Since many kernel rootkits make branches that differ from the usual branches in the kernel space, KRGuard can detect these differences by using hardware features of commodity processors. Our evaluation shows that KRGuard can detect kernel rootkits with small overhead.

Kernel Rootkits Detection Method by Monitoring Branches Using Hardware Features

“…We mentioned that the existing kernel rootkit detection methods cannot resolve all of the following problems simultaneously [3]: (1) cannot detect kernel rootkits immediately, (2) cannot keep the extensibility of the OS kernel, and (3) cannot be applied to different OS and OS versions.…”

“…* Preliminary works of this paper were presented at [1], [2]. a) E-mail: yamauchi@cs.okayama-u.ac.jp DOI: 10.1587/transinf.2016INL0003…”

“…The preliminary version of this paper appeared in [1], [2]. This paper describes the originality, effectiveness and limitations of KRGuard in detail.…”