Authors:
Satyajit Grover
;
Divya Naidu Kolar Sunder
;
Samuel O. Moffatt
and
Michael E. Kounavis
Affiliation:
Corporate Technology Group, Intel Corporation, United States
Keyword(s):
Rootkits, Kernel, Security, Virtualization, Hypervisor.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Security Engineering
;
Security in Information Systems
;
Security Information Systems Architecture and Design and Security Patterns
Abstract:
In this paper we address the problem of protecting computer systems against stealth malware. The problem is important because the number of known types of stealth malware increases exponentially. Existing approaches have some advantages for ensuring system integrity but sophisticated techniques utilized by stealthy malware can thwart them. We propose Runtime Kernel Rootkit Detection (RKRD), a hardware-based, event-driven, secure and inclusionary approach to kernel integrity that addresses some of the limitations of the state of the art. Our solution is based on the principles of using virtualization hardware for isolation, verifying signatures coming from trusted code as opposed to malware for scalability and performing system checks driven by events. Our RKRD implementation is guided by our goals of strong isolation, no modifications to target guest OS kernels, easy deployment, minimal infrastructure impact, and minimal performance overhead. We developed a system prototype and condu
cted a number of experiments which show that the performance impact of our solution is negligible.
(More)