IDTchecker: Rule-based Integrity Checking of Interrupt Descriptor Tables in Cloud Environments

摘要: An interrupt descriptor table (IDT) is used by the processor to transfer execution of a program special software routines that handle interrupts, which might be raised during normal course operation hardware or signal exceptional conditions, such as failure. Attackers frequently modify pointers in IDT order execute malicious code. In this paper we present IDTchecker, provides comprehensive rulebased approach check integrity and corresponding handling code, based on particular scenario commonly found cloud environments. scenario, multiple virtual machines (VMs) run same version an OS kernel, implies related code should also identical across pool VMs. IDTchecker uses compare IDTs handlers VMs for any inconsistencies, pre-defined set rules. We thoroughly evaluate effectiveness runtime performance find it can detect change without having significant impact guest VMs’ system resources. Moreover, itself has very small memory footprint (i.e. 10-15MB).