Hardware-Assisted Rootkit Detection via On-line Statistical Fingerprinting of Process Execution
Liwei Zhoua and Yiorgos Makrisb
The University of Texas at Dallas, Richardson,USA
alxz100320@utdallas.edu
bgxm112130@utdallas.edu
ABSTRACT
Kernel root kits generally attempt to maliciously tamper kernel objects and surreptitiously distort program execution flow. Herein, we introduce a hardware‐assisted hierarchical on-line system which detects such kernel root kits by identifying deviation of dynamic intra‐process execution profiles based on architecture‐level semantics captured directly in hardware. The underlying key insight is that, in order to take effect, malicious manipulation of kernel objects must distort the execution flow of benign processes, thereby leaving abnormal traces in architecture‐level semantics. While traditional detection methods rely on software modules to collect such traces, their implementations are susceptible to being compromised through software attacks. In contrast, our detection system maintains immunity to software attacks by resorting to hardware for trace collection. The proposed method is demonstrated on a Linuxbased operating system running on a 32‐bit x86 architecture, implemented in Simics. Experimental results, using real‐world kernel root kits, corroborate the effectiveness of this method, while a predictive 45nm PDK is used to evaluate hardware overhead.
