File Download

There are no files associated with this item.

  • Find it @ UNIST can give you direct access to the published full text of this article. (UNISTARs only)
Related Researcher


Moon, Hyungon
Computer Systems Security Lab.
Read More

Views & Downloads

Detailed Information

Cited time in webofscience Cited time in scopus
Metadata Downloads

Full metadata record

DC Field Value Language
dc.citation.endPage 157 -
dc.citation.number 2 -
dc.citation.startPage 145 -
dc.citation.volume 14 - Moon, Hyungon - Lee, Hojoon - Heo, Ingoo - Kim, Kihwan - Paek, Yunheung - Kang, Brent Byunghoon - 2023-12-21T22:37:12Z - 2023-12-21T22:37:12Z - 2018-08-14 - 2017-03 -
dc.description.abstract To protect the integrity of operating system kernels, we present Vigilare system, a kernel integrity monitor that is architected to snoop the bus traffic of the host system from a separate independent hardware. This snoop-based monitoringenabled by the Vigilare system, overcomes the limitations of the snapshot-based monitoring employed in previous kernel integrity monitoring solutions. Being based on inspecting snapshots collected over a certain interval, the previous hardware-based monitoring solutions cannot detect transient attacks that can occur in between snapshots, and cannot protect the kernel against permanent damage. We implemented three prototypes of the Vigilare system by adding Snooper hardware connections module to the host system for bus snooping, and a snapshot-based monitor to be comared with, in order to evaluate the benefit of snoop-based monitoring. The prototypes of Vigilare system detected all the transient attacks and the second one protected the kernel with negligible performance degradation while the snapshot-based monitor could not detect all the attacks and induced considerable performance degradation as much as 10 percent in our tuned STREAM benchmark test. -
dc.identifier.bibliographicCitation IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, v.14, no.2, pp.145 - 157 -
dc.identifier.doi 10.1109/TDSC.2015.2443803 -
dc.identifier.issn 1545-5971 -
dc.identifier.scopusid 2-s2.0-85021748519 -
dc.identifier.uri -
dc.identifier.url -
dc.identifier.wosid 000396397200003 -
dc.language 영어 -
dc.publisher IEEE COMPUTER SOC -
dc.title Detecting and Preventing Kernel Rootkit Attacks with Bus Snooping -
dc.type Article -
dc.description.journalRegisteredClass scie -
dc.description.journalRegisteredClass scopus -


Items in Repository are protected by copyright, with all rights reserved, unless otherwise indicated.