Hardware-assisted rootkit detection via on-line statistical fingerprinting of process execution

摘要: Kernel rootkits generally attempt to maliciously tamper kernel objects and surreptitiously distort program execution flow. Herein, we introduce a hardware-assisted hierarchical on-line system which detects such by identifying deviation of dynamic intra-process profiles based on architecture-level semantics captured directly in hardware. The underlying key insight is that, order take effect, malicious manipulation must the flow benign processes, thereby leaving abnormal traces semantics. While traditional detection methods rely software modules collect traces, their implementations are susceptible being compromised through attacks. In contrast, our maintains immunity attacks resorting hardware for trace collection. proposed method demonstrated Linux-based operating running 32-bit x86 architecture, implemented Simics. Experimental results, using real-world rootkits, corroborate effectiveness this method, while predictive 45nm PDK used evaluate overhead.