Characterizing Kernel malware behavior with kernel data access patterns

Proceedings of the 6th International Symposium on Information, Computer and Communications Security, ASIACCS 2011

Volumn , Issue , 2011, Pages 207-216

  Rhee, Junghwan ^a   Lin, Zhiqiang ^a   Xu, Dongyan ^a  

^a Purdue University   (United States)

Author keywords

Kernel data access patterns; Kernel malware analysis; Kernel malware signature

Indexed keywords

DATA OBFUSCATION; STATIC ANALYSIS;

DATA ACCESS PATTERNS; DYNAMICS ANALYSIS; KERNEL DATA ACCESS PATTERN; KERNEL MALWARE ANALYSE; KERNEL MALWARE SIGNATURE; MALWARE ANALYSIS; MALWARE BEHAVIORS; MALWARES; NEW APPROACHES; TEMPORAL ORDERING;

MALWARE;

EID: 79956028075     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1966913.1966940     Document Type: Conference Paper

References (27)

1. A. Baliga, V. Ganapathy, and L. Iftode. Automatic Inference and Enforcement of Kernel Data Structure Invariants. In Proceedings of the 24th Annual Computer Security Applications Conference (ACSAC'08), December 2008.
2. D. Balzarotti, M. Cova, C. Karlberger, C. Kruegel, E. Kirda, and G. Vigna. Efficient Detection of Split Personalities in Malware. In Proceedings of the 17th Annual Network and Distributed System Security Symposium (NDSS'10), 2010.
3. U. Bayer, P. Milani Comparetti, C. Hlauscheck, C. Kruegel, and E. Kirda. Scalable, Behavior-Based Malware Clustering. In 16th Symposium on Network and Distributed System Security (NDSS'09), 2009.
4. F. Bellard. QEMU: A Fast and Portable Dynamic Translator. In Proceedings of the USENIX Annual Technical Conference, FREENIX Track, pages 41-46, 2005.
5. S. Bratus, M. E. Locasto, and B. R. Schulte. SegSlice: Towards a New Class of Secure Programming Primitives for Trustworthy Platforms. In the 3rd International Conference on Trust and Trustworthy Computing (TRUST'10), 2010.
6. J. Butler. DKOM (Direct Kernel Object Manipulation). http://www.blackhat. com/presentations/win-usa-04/bh-win-04-butler.pdf.
7. M. Carbone, W. Cui, L. Lu, W. Lee, M. Peinado, and X. Jiang. Mapping Kernel Objects to Enable Systematic Integrity Checking. In Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS'09), 2009.
8. M. Christodorescu and S. Jha. Static Analysis of Executables to Detect Malicious Patterns. In Proceedings of the 12th USENIX Security Symposium (Security'03).
9. M. Christodorescu, C. Kruegel, and S. Jha. Mining Specifications of Malicious Behavior. In Proceedings of the 6th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE'07).
10. C. Collberg, C. Thomborson, and D. Low. Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs. In Principles of Programming Languages 1998 (POPL'98).
11. A. Cozzie, F. Stratton, H. Xue, and S. T. King. Digging For Data Structures. In Proceedings of the 8th USENIX Symposium on Operating Systems Design and Implementation (OSDI'08), 2008.
12. B. Dolan-Gavitt, A. Srivastava, P. Traynor, and J. Giffin. Robust Signatures for Kernel Data Structures. In Proceedings of the 16th ACM conference on Computer and communications security (CCS'09), 2009.
13. R. Hund, T. Holz, and F. C. Freiling. Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms. In Proceedings for the 18th USENIX Security Symposium (Security'09), 2009.
14. C. Kolbitsch, P. Milani Comparetti, C. Kruegel, E. Kirda, X. Zhou, and X. Wang. Effective and Efficient Malware Detection at the End Host. In 18th USENIX Security Symposium (Security'09), 2009.
15. C. Kruegel, W. Robertson, and G. Vigna. Detecting Kernel-Level Rootkits Through Binary Analysis. In Proceedings of the 20th Annual Computer Security Applications Conference (ACSAC'04), 2004.
16. Z. Lin, J. Rhee, X. Zhang, D. Xu, and X. Jiang. SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures. In Proceedings of the 18th Annual Network and Distributed System Security Symposium (NDSS'11), San Diego, CA, February 2011.
17. N. L. Petroni, T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - A Coprocessor-based Kernel Runtime Integrity Monitor. In Proceedings for the 13th USENIX Security Symposium (Security'04), August 2004.
18. N. L. Petroni and M. Hicks. Automated Detection of Persistent Kernel Control-Flow Attacks. In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS'07), 2007.
19. N. L. Petroni Jr., T. Fraser, A. Walters, and W. A. Arbaugh. An Architecture for Specification-Based Detection of Semantic Integrity Violations in Kernel Dynamic Data. In Proceedings of the 15th conference on USENIX Security Symposium (Security'06), 2006.
20. Phrack Magazine. Linux on-the-y kernel patching without LKM. http://www.phrack.com/issues.html?issue=58&id=7.
21. J. Rhee, R. Riley, D. Xu, and X. Jiang. Kernel Malware Analysis with Un-tampered and Temporal Views of Dynamic Kernel Memory. In Proceedings of the 13th International Symposium of Recent Advances in Intrusion Detection (RAID'10), Ottawa, Canada, September 2010.
22. R. Riley, X. Jiang, and D. Xu. Multi-Aspect Profiling of Kernel Rootkit Behavior. In Proceedings of the 4th European Conference on Computer Systems (Eurosys'09).
23. R. Riley, X. Jiang, and D. Xu. Guest-Transparent Prevention of Kernel Rootkits with VMM-based Memory Shadowing. In Proceedings of 11th International Symposium on Recent Advances in Intrusion Detection (RAID'08), 2008.
24. A. Seshadri, M. Luk, N. Qu, and A. Perrig. SecVisor: A Tiny Hypervisor to Provide Lifetime Kernel Code Integrity for Commodity OSes. In Proceedings of 21st Symposium on Operating Systems Principles (SOSP'07). ACM, 2007.
25. M. Sharif, A. Lanzi, J. Giffin, and W. Lee. Impeding Malware Analysis Using Conditional Code Obfuscation. In Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS'08), 2009.
26. C. Wang, J. Hill, J. C. Knight, and J. W. Davidson. Protection of Software-Based Survivability Mechanisms. In Proceedings of the 2001 International Conference on Dependable Systems and Networks (DSN'01), 2001.
27. C. Xuan, J. A. Copeland, and R. A. Beyah. Toward Revealing Kernel Malware Behavior in Virtual Execution Environments. In Proceedings of 12th International Symposium on Recent Advances in Intrusion Detection (RAID'09), 2009.