Defeating Dynamic Data Kernel Rootkit Attacks via VMM-Based Guest-Transparent Monitoring

摘要: Targeting the operating system kernel, core of trust in a system, kernel rootkits are able to compromise entire placing it under malicious control, while eluding detection efforts. Within realm rootkits, dynamic data particularly elusive due fact that they attack only targets. Dynamic avoid code injection and instead use existing manipulate data. Because do not execute any new code, complete their attacks without violating integrity. We propose prevention solution blocks rootkit by monitoring memory access using virtual machine monitor (VMM) policies. Although VMM is an external monitor, our preemptively detects changes monitored states enables fine-grained inspection accesses on dynamically changing In addition, readable writable can be protected exposing illegal rootkits.We have implemented prototype QEMU VMM. Our experiments show successfully defeats synthesized real-time, demonstrating its effectiveness practicality.