Efficient Kernel Integrity Monitor Design for Commodity Mobile Application Processors
Autor: | Yunheung Paek, Hyungon Moon, Seung-Wook Lee, Hansu Cho, Ingoo Heo, Daehee Jang, Brent Byunghoon Kang |
---|---|
Rok vydání: | 2015 |
Předmět: |
Interconnection
Engineering business.industry Controller (computing) Rootkit computer.software_genre Electronic Optical and Magnetic Materials Kernel (linear algebra) Embedded system Operating system Overhead (computing) Memory model Electrical and Electronic Engineering Crossbar switch business Host (network) computer |
Zdroj: | JSTS:Journal of Semiconductor Technology and Science. 15:48-59 |
ISSN: | 1598-1657 |
Popis: | In recent years, there are increasing threats of rootkits that undermine the integrity of a system by manipulating OS kernel. To cope with the rootkits, in Vigilare, the snoop-based monitoring which snoops the memory traffics of the host system was proposed. Although the previous work shows its detection capability and negligible performance loss, the problem is that the proposed design is not acceptable in recent commodity mobile application processors (APs) which have become de facto the standard computing platforms of smart devices. To mend this problem and adopt the idea of snoop-based monitoring in commercial products, in this paper, we propose a snoop-based monitor design called S-Mon, which is designed for the AP platforms. In designing S-Mon, we especially consider two design constraints in the APs which were not addressed in Vigilare; the unified memory model and the crossbar switch interconnect. Taking into account those, we derive a more realistic architecture for the snoop-based monitoring and a new hardware module, called the region controller, is also proposed. In our experiments on a simulation framework modeling a production-quality device, it is shown that our S-Mon can detect the rootkit attacks while the runtime overhead is also negligible. |
Databáze: | OpenAIRE |
Externí odkaz: |