NumChecker: Detecting kernel control-flow modifying rootkits by using hardware performance counters

Xueyang Wang, Ramesh Karri

Research output: Chapter in Book/Report/Conference proceedingConference contribution


This paper presents NumChecker, a new Virtual Machine Monitor (VMM) based framework to detect control-flow modifying kernel rootkits in a guest Virtual Machine (VM). NumChecker detects malicious modifications to a system call in the guest VM by checking the number of certain hardware events that occur during the system call's execution. To automatically count these events, NumChecker leverages the Hardware Performance Counters (HPCs), which exist in most modern processors. By using HPCs, the checking cost is significantly reduced and the tamper-resistance is enhanced. We implement a prototype of NumChecker on Linux with the Kernelbased Virtual Machine (KVM). Our evaluation demonstrates its practicality and effectiveness.

Original languageEnglish (US)
Title of host publicationProceedings of the 50th Annual Design Automation Conference, DAC 2013
Publication statusPublished - 2013
Event50th Annual Design Automation Conference, DAC 2013 - Austin, TX, United States
Duration: May 29 2013Jun 7 2013


Other50th Annual Design Automation Conference, DAC 2013
CountryUnited States
CityAustin, TX



  • Hardware performance counters
  • Kernel rootkits
  • Virtualization

ASJC Scopus subject areas

  • Computer Science Applications
  • Control and Systems Engineering
  • Electrical and Electronic Engineering
  • Modeling and Simulation

Cite this