KI-Mon ARM: A Hardware-assisted Event-triggered Monitoring Platform for Mutable Kernel Object
Cited 0 times inCited 0 times in
- KI-Mon ARM: A Hardware-assisted Event-triggered Monitoring Platform for Mutable Kernel Object
- Lee, Hojoon; Moon, Hyungon; Heo, Ingoo; Jang, Daehee; Jang, Jinsoo; Kim, Kihwan; Paek, Yunheung; Kang, Brent
- Issue Date
- IEEE COMPUTER SOC
- IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, v., no., pp. -
- External hardware-based kernel integrity monitors have been proposed to mitigate kernel-level malwares. However, the existing external approaches have been limited to monitoring the static regions of kernel while the latest rootkits manipulate the dynamic kernel objects. To address the issue, we present KI-Mon, a hardware-based platform that introduces eventtriggered monitoring techniques for kernel dynamic objects. KIMon advances the bus traffic snooping technique to not only detect memory write traffic on the host bus but also filter out all but meaningful traffic to generate events. We show how kernel invariant verification software can be developed around these events, and also provide a set of APIs for additional invariant verification development. We also report our findings and considerations on the unique challenges for external monitors – such as cache coherency, dynamic object tracing. We introduce host-side kernel changes that alleviate these issues that involve changes in kernel’s object allocation and cache policy control. We have built a prototype of KI-Mon on the ARM architecture to demonstrate the efficacy of KI-Mon’s event-triggered mechanism in terms of performance overhead for the monitored host system and the processor usage of the KI-Mon processor.
- ; Go to Link
Appears in Collections:
- ECE_Journal Papers
- Files in This Item:
- There are no files associated with this item.
can give you direct access to the published full text of this article. (UNISTARs only)
Show full item record
Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.