NumChecker: Detecting kernel control-flow modifying rootkits by using hardware performance counters

Xueyang Wang, Ramesh Karri

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

This paper presents NumChecker, a new Virtual Machine Monitor (VMM) based framework to detect control-flow modifying kernel rootkits in a guest Virtual Machine (VM). NumChecker detects malicious modifications to a system call in the guest VM by checking the number of certain hardware events that occur during the system call's execution. To automatically count these events, NumChecker leverages the Hardware Performance Counters (HPCs), which exist in most modern processors. By using HPCs, the checking cost is significantly reduced and the tamper-resistance is enhanced. We implement a prototype of NumChecker on Linux with the Kernelbased Virtual Machine (KVM). Our evaluation demonstrates its practicality and effectiveness.

Original languageEnglish (US)
Title of host publicationProceedings of the 50th Annual Design Automation Conference, DAC 2013
DOIs
Publication statusPublished - 2013
Event50th Annual Design Automation Conference, DAC 2013 - Austin, TX, United States
Duration: May 29 2013Jun 7 2013

Other

Other50th Annual Design Automation Conference, DAC 2013
CountryUnited States
CityAustin, TX
Period5/29/136/7/13

    Fingerprint

Keywords

  • Hardware performance counters
  • Kernel rootkits
  • Virtualization

ASJC Scopus subject areas

  • Computer Science Applications
  • Control and Systems Engineering
  • Electrical and Electronic Engineering
  • Modeling and Simulation

Cite this