FACE-CHANGE: Application-driven dynamic kernel view switching in a virtual machine

Proceedings of the International Conference on Dependable Systems and Networks

Volumn , Issue , 2014, Pages 491-502

  Gu, Zhongshu ^a   Saltaformaggio, Brendan ^a   Zhang, Xiangyu ^a   Xu, Dongyan ^a  

^a Purdue University   (United States)

Author keywords

Attack Provenance; Attack Surface Minimization; Virtualization

Indexed keywords

VIRTUALIZATION;

ANOMALOUS BEHAVIOR; ATTACK PROVENANCE; DYNAMIC SWITCHING; EXECUTION ENVIRONMENTS; KERNEL IMAGE; MISSING CODES; RUNTIMES; TRUSTED COMPUTING BASE;

VIRTUAL MACHINE;

EID: 84912106901     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DSN.2014.52     Document Type: Conference Paper

References (37)

1. A. Kurmus, R. Tartler, D. Dorneanu, B. Heinloth, V. Rothberg, A. Ruprecht, W. Schröder-Preikschat, D. Lohmann, and R. Kapitza, "Attack surface metrics and automated compiletime os kernel tailoring, " in Proceedings of the 20th Network and Distributed System Security Symposium, 2013.
2. C. tai Lee, J. min Lin, Z. wei Hong, and W. tsong Lee, " An application-oriented linux kernel customization for embedded systems," Journal of Information Science and Engineering, 1995.
3. H. He, S. K. Debr ay, and G. R. Andrews, " The revenge of the overlay: automatic compaction of os kernel code via ondemand code loading," in Proceedings of the 7th ACM & IEEE international conference on Embedded software, 2007.
4. D. Chanet, B. De Sutter, B. De Bus, L. Van Put, and K. De Bosschere, " System-wide compaction and specialization of the linux kernel," in Proceedings of the 2005 ACM SIGPLAN/SIGBED Conference on Languages, Compilers, and Tools for Embedded Systems, 2005.
5. C. Cadar, D. Dunbar, and D. Engler, " Klee: Unassisted and automatic generation of high-coverage tests for complex systems programs," in Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation, 2008.
6. P. Godefroid, N. Klarlund, and K. Sen, "Dart: Directed automated random testing, " in Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation, 2005.
7. K. Sen, D. Marinov, and G. Agha, "Cute: A concolic unit testing engine for c, " in Proceedings of the 10th European Software Engineering C onference Held Jointly with 13th ACM SIGSOFT International Symposium on Foundations of Software Engineering, 2005.
8. F. Bellard, "Qemu, a fast and portable dynamic translator, " in Proceedings of the Annual Confer ence on USENIX Annual Technical Conference, 2005.
9. "RUBiS, " http://rubis.ow2.org/.
10. "injectso: Modifying and spying on running processes under linux, " http://www.blackhat.com/presentation s/bh-europe-01/shaun-clowes/bh-europe-01-clowes.ppt.
11. "Cymothoa-Stealth backdooring tool, " http://cymothoa. sourceforge.net/.
12. "Single Process Parasite, " http://www.phrack.org/issues.html? issue=68&id=9#article.
13. "Injected Evil(executable files infection), " http://z0mbie.host. sk/infelf.html.
14. "kbeast-v1, " http://core.ipsecs.com/rootkit/kernel-rootkit/kbeast-v1/.
15. J. Butler, "DKOM (Direct Kernel Object Manipulation).
16. J. Rhee, R. Riley, D. Xu, and X. Jiang, " Kernel malware analysis with un-tampered and temporal views of dynamic kernel memory," in Proceedings of the 13th International Conference on Recent Advances in Intrusion Detection, 2010.
17. J. Rhee, R. Riley, D. Xu, and X. Jiang, " Defeating dynamic data kernel rootkit attacks via vmm-based guest-transparent monitoring," in Availability, Reliability and Security, 2009. ARES '09. International Conference on, 2009.
18. Z. Gu, W. N. Sumner, Z. Deng, X. Zhang, and D. Xu, " Drip: A framework for purifying trojaned kernel drivers," in Proceedings of the 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks(DSN), 2013.
19. I. Goldberg, D. Wagner, R. Thomas, and E. A. Brewer, " A secure environment for untrusted helper applications: Confining the wily hacker," in Proceedings of the Sixth USENIX Security Symposium, 1996.
20. T. Garfinkel, B. Pfaff, and M. Rosenblum, "Ostia: A delegating architecture for secure system call interposition. " in Proceedings of the 11th Annual Network and Distributed System Security Symposium, 2004.
21. R. N. Watson,J. Anderson,B. Laurie,K. Kennaway Capsicum: Practical capabilities for unix." in Proceedings of the 19th USENIX Security Symposium 2010.
22. "Seccomp and sandboxing, " http://lwn.net/Articles/332974/.
23. P. Loscocco and S. Smalley, "Integrating flexible support for security policies into the linux operating system, " in Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference, 2001.
24. M. Bauer, "Paranoid penguin: An introduction to novell apparmor, " Linux Journal, 2006.
25. S. Jana, D. Porter, and V. Shmatikov, " Txbox: Building secure, efficient sandboxes with system transactions," in Security and Privacy (SP), 2011 IEEE Symposium on, 2011.
26. H. Vijayakumar, J. Schiffman, and T. Jaeger, "Process firewalls: Protecting processes during resource access, " in Proceedings of the 8th ACM European Conference on Computer Systems, 2013.
27. S. McCamant and G. Morrisett, "Evaluating sfi for a cisc architecture, " in Proceedings of the 15th USENIX Security Symposium, 2006.
28. R. Wahbe, S. Lucco, T. E. Anderson, and S. L. Graham, " Efficient software-based fault isolation," in Proceedings of the 14th ACM Symposium on Operating Systems Principles, 1993.
29. B. Ford and R. Cox, "Vx32: Lightweight user-level sandboxing on the x86, " in USENIX 2008 Annual Technical Conference on Annual Technical Conference, 2008.
30. B. Yee, D. Sehr, G. Dardyk, J. B. Chen, R. Muth, T. Ormandy, S. Okasaka, N. Narula, and N. Fullagar, " Native client: A sandbox for portable, untrusted x86 native code, " in Security and Privacy, 2009 30th IEEE Symposium on, 2009.
31. M. Payer, T. Hartmann, and T. R. Gross, "Safe loading-a foundation for secure execution of untrusted programs, " in Security and Privacy (SP), 2012 IEEE Symposium on, 2012.
32. V. Kiriansky, D. Bruening, and S. P. Amarasinghe, "Secure execution via program shepherding, " in Proceedings of the 11th USENIX Secur ity Symposium, 2002.
33. A. Seshadri, M. Luk, N. Qu, and A. Perrig, " SecVisor: A tiny hypervisor to provide lifetime kernel code integrity for commodity OSes," in Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles, 2007.
34. R. Riley, X. Jiang, and D. Xu, " Guest-transparent prevention of kernel rootkits with vmm-based memory shadowing," in Proceedings of the 11th International Symposium on Recent Advances in Intrusion Detection, 2008.
35. Z. Wang, X. Jiang, W. Cui, and P. Ning, "Countering kernel rootkits with lightweight hook protection, " in Proceedings of the 16th ACM conference o n Computer and communications security, 2009.
36. X. Xiong, D. Tian, and P. Liu, "Practical Protection of Kernel Integrity for Commodity OS from Untrusted Extensions, " in Proceedings of the 18th Annual Network and Distributed System Security Symposium, 2011.
37. A. Srivastava and J. Giffin, "Efficient Monitoring of Untrusted Kernel-Mode Execution, " in Proceedings of the 18th Annual Network and Distributed Systems Securi ty Symposium, 2011.