Vigilare: Toward snoop-based kernel integrity monitor

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2012, Pages 28-37

  Moon, Hyungon ^a   Lee, Hojoon ^b   Lee, Jihoon ^a   Kim, Kihwan ^b   Paek, Yunheung ^a   Kang, Brent Byunghoon ^c  

^a Seoul National University   (South Korea)

^b Korea Advanced Institute of Science and Technology (KAIST)   (South Korea)

^c GEORGE MASON UNIVERSITY   (United States)

Author keywords

Hardware based integrity monitor; Kernel integrity monitor; Transient attack

Indexed keywords

BENCHMARK TESTS; BUS TRAFFIC; INTEGRITY MONITOR; INTEGRITY MONITORING; PERFORMANCE DEGRADATION; SYSTEM-ON-A-CHIP; VIGILARE SYSTEMS;

APPLICATION SPECIFIC INTEGRATED CIRCUITS; BENCHMARKING; COMPUTER HARDWARE; HARDWARE;

SECURITY OF DATA;

EID: 84869408742     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2382196.2382202     Document Type: Conference Paper

References (30)

1. Vmware : Vulnerability statistics. http://www.cvedetails.com/vendor/252/ Vmware.html.
2. Vulnerability report: Vmware esx server 3.x. http://secunia.com/ advisories/product/10757.
3. Vulnerability report: Xen 3.x. http://secunia.com/advisories/product/ 15863.
4. Xen : Security vulnerabilities. http://www.cvedetails.com/ vulnerabilitylist/vendor-id-6276/XEN.html.
5. Aeroex Gaisle. GRLIB IP Core User's Manual, January 2012.
6. ARM Limited. AMBA™ Specification, May 1999.
7. A. M. Azab, P. Ning, Z. Wang, X. Jiang, X. Zhang, and N. C. Skalsky. Hypersentry: enabling stealthy in-context measurement of hypervisor integrity. In Proceedings of the 17th ACM conference on Computer and communications security, CCS '10, pages 38-49, New York, NY, USA, 2010. ACM.
8. A. Baliga, V. Ganapathy, and L. Iftode. Automatic inference and enforcement of kernel data structure invariants. In Computer Security Applications Conference, 2008. ACSAC 2008. Annual, pages 77 -86, dec. 2008.
9. J. Bickford, R. O'Hare, A. Baliga, V. Ganapathy, and L. Iftode. Rootkits on smart phones: attacks, implications and opportunities. In Proceedings of the Eleventh Workshop on Mobile Computing Systems & Applications, HotMobile '10, pages 49-54, New York, NY, USA, 2010. ACM.
10. Y. Bulygin and D. Samyde. Chipset based approach to detect virtualization malware a.k.a. deepwatch. In BlackHat USA, 2008.
11. D. Clarke, G. E. Suh, B. Gassend, M. van Dijk, and S. Devadas. Checking the integrity of a memory in a snooping-based symmetric multiprocessor (smp) system. Technical report, MIT LCS memo-470, http://csg.csail.mit.edu/pubs/memos/ Memo-470/smpMemoryMemo.pdf, 2004.
12. L. Duot, D. Etiemble, and O. Grumelard. Using cpu system management mode to circumvent operating system security functions. In In Proceedings of the 7th CanSecWest conference, 2006.
13. T. Garfinkel, B. Pfaff, J. Chow, M. Rosenblum, and D. Boneh. Terra: a virtual machine-based platform for trusted computing. In Proceedings of the nineteenth ACM symposium on Operating systems principles, SOSP '03, pages 193-206, New York, NY, USA, 2003. ACM.
14. T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Proc. Network and Distributed Systems Security Symposium, February 2003.
15. D. Hellström. SnapGear Linux for LEON. Gaisler Research, November 2008.
16. D. Hollingworth and T. Redmond. Enhancing operating system resistance to information warfare. In MILCOM 2000. 21st Century Military Communications Conference Proceedings, volume 2, pages 1037 -1041 vol.2, 2000.
17. K. Kaneda. Tiny virtual machine monitor. http://www.yl.is.s.u-tokyo.ac. jp/~kaneda/tvmm/.
18. J. D. McCalpin. Memory bandwidth and machine balance in current high performance computers. IEEE Computer Society Technical Committee on Computer Architecture (TCCA) Newsletter, pages 19-25, Dec. 1995.
19. R. Pellizzoni, P. Meredith, M. Caccamo, and G. Rosu. Hardware runtime monitoring for dependable cots-based real-time embedded systems. In Proceedings of the 2008 Real-Time Systems Symposium, RTSS '08, pages 481-491, Washington, DC, USA, 2008. IEEE Computer Society.
20. N. L. Petroni, Jr., T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - a coprocessor-based kernel runtime integrity monitor. In Proceedings of the 13th conference on USENIX Security Symposium - Volume 13, SSYM'04, pages 13-13, Berkeley, CA, USA, 2004. USENIX Association.
21. N. L. Petroni, Jr., T. Fraser, A. Walters, and W. A. Arbaugh. An architecture for specification-based detection of semantic integrity violations in kernel dynamic data. In Proceedings of the 15th conference on USENIX Security Symposium - Volume 15, USENIX-SS'06, Berkeley, CA, USA, 2006. USENIX Association.
22. N. L. Petroni, Jr. and M. Hicks. Automated detection of persistent kernel control-flow attacks. In Proceedings of the 14th ACM conference on Computer and communications security, CCS '07, pages 103-115, New York, NY, USA, 2007. ACM.
23. N. A. Quynh and Y. Takefuji. A novel approach for a file-system integrity monitor tool of xen virtual machine. In Proceedings of the 2nd ACM symposium on Information, computer and communications security, ASIACCS '07, pages 194-202, New York, NY, USA, 2007. ACM.
24. J. Rhee, R. Riley, D. Xu, and X. Jiang. Defeating dynamic data kernel rootkit attacks via vmm-based guest-transparent monitoring. In Availability, Reliability and Security, 2009. ARES '09. International Conference on, pages 74 -81, march 2009.
25. R. Russell. Lguest: The simple x86 hypervisor. http://lguest.ozlabs.org/.
26. A. Seshadri, M. Luk, N. Qu, and A. Perrig. Secvisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity oses. In Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles, SOSP '07, pages 335-350, New York, NY, USA, 2007. ACM.
27. SPARC International Inc. The SPARC Architecture Manual, 1992.
28. J. Wang, A. Stavrou, and A. Ghosh. Hypercheck: A hardware-assisted integrity monitor. In S. Jha, R. Sommer, and C. Kreibich, editors, Recent Advances in Intrusion Detection, volume 6307 of Lecture Notes in Computer Science, pages 158-177. Springer Berlin /Heidelberg, 2010. 10.1007/978-3-642- 15512-3-9.
29. J. Wei, B. Payne, J. Giffin, and C. Pu. Soft-timer driven transient kernel control flow attacks and defense. In Computer Security Applications Conference, 2008. ACSAC 2008. Annual, pages 97 -107, dec. 2008.
30. X. Zhang, L. van Doorn, T. Jaeger, R. Perez, and R. Sailer. Secure coprocessor-based intrusion detection. In Proceedings of the 10th workshop on ACM SIGOPS European workshop, EW 10, pages 239-242, New York, NY, USA, 2002. ACM.