NDLI: Mapping kernel objects to enable systematic integrity checking

Please wait, while we are loading the content...

Attacking cryptographic schemes based on "perturbation polynomials"

EPC RFID tag security weaknesses and defenses: passport cards, enhanced drivers licenses, and beyond

CoSP: a general framework for computational soundness proofs

Efficient pseudorandom functions from the decisional linear assumption and weaker variants

NISAN: network information service for anonymization networks

Ripley: automatically securing web 2.0 applications through replicated execution

On cellular botnets: measuring the impact of malicious devices on a cellular network core

Battle of Botcraft: fighting bots in online games with human observational proofs

The fable of the bees: incentivizing robust revocation decision making in ad hoc networks

On non-cooperative location privacy: a game-theoretic analysis

The bayesian traffic analysis of mix networks

On the difficulty of software-based attestation of embedded devices

A security-preserving compiler for distributed programs: from information-flow policies to cryptographic mechanisms

On voting machine design for verification and testability

Can they hear me now?: a security analysis of law enforcement wiretaps

Countering kernel rootkits with lightweight hook protection

A new cell counter based attack against tor

Large-scale malware indexing using function-call graphs

Filter-resistant code injection on ARM

An efficient forward private RFID protocol

Reactive noninterference

Improving privacy and security in multi-authority attribute-based encryption

Certificateless onion routing

HAIL: a high-availability and integrity layer for cloud storage

On lightweight mobile phone application certification

Fides: remote anomaly-based cheat detection using client emulation

Effective implementation of the cell broadband engine™ isolation loader

Privacy-preserving genomic computation through program specialization

As-awareness in Tor path selection

Proximity-based access control for implantable medical devices

Finding bugs in exceptional situations of JNI programs

Secure in-VM monitoring using hardware virtualization

English shellcode

Mapping kernel objects to enable systematic integrity checking

Scalable onion routing with torsk

Dispatcher: enabling active botnet infiltration using automatic protocol reverse-engineering

False data injection attacks against state estimation in electric power grids

RFID privacy: relation between two notions, minimal condition, and efficient construction

Computational soundness for key exchange protocols with symmetric encryption

Oblivious transfer with access control

ShadowWalker: peer-to-peer anonymous communication using redundant structured topologies

Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds

SMILE: encounter-based trust for mobile social services

Behavior based software theft detection

On achieving good operating points on an ROC plane using stochastic anomaly score prediction

Feeling-based location privacy protection for location-based services

Membership-concealing overlay networks

XCS: cross channel scripting and its impact on web applications

Secure open source collaboration: an empirical study of linus' law

A metadata calculus for secure information sharing

Learning your identity and disease from research papers: information leaks in genome wide association study

Robust signatures for kernel data structures

Anonymous credentials on a standard java card

Your botnet is my botnet: analysis of a botnet takeover

A probabilistic approach to hybrid role mining

Dynamic provable data possession

Multi-party off-the-record messaging

Multiple password interference in text passwords and click-based graphical passwords

Mapping kernel objects to enable systematic integrity checking

Content Provider	ACM Digital Library
Author	Cui, Weidong Lu, Long Lee, Wenke Carbone, Martim Peinado, Marcus Jiang, Xuxian
Abstract	Dynamic kernel data have become an attractive target for kernel-mode malware. However, previous solutions for checking kernel integrity either limit themselves to code and static data or can only inspect a fraction of dynamic data, resulting in limited protection. Our study shows that previous solutions may reach only 28% of the dynamic kernel data and thus may fail to identify function pointers manipulated by many kernel-mode malware. To enable systematic kernel integrity checking, in this paper we present KOP, a system that can map dynamic kernel data with nearly complete coverage and nearly perfect accuracy. Unlike previous approaches, which ignore generic pointers, unions and dynamic arrays when locating dynamic kernel objects, KOP (1) applies inter-procedural points-to analysis to compute all possible types for generic pointers (e.g., void*), (2) uses a pattern matching algorithm to resolve type ambiguities (e.g., unions), and (3) recognizes dynamic arrays by leveraging knowledge of kernel memory pool boundaries. We implemented a prototype of KOP and evaluated it on a Windows Vista SP1 system loaded with 63 kernel drivers. KOP was able to accurately map 99% of all the dynamic kernel data. To demonstrate KOP's power, we developed two tools based on it to systematically identify malicious function pointers and uncover hidden kernel objects. Our tools correctly identified all malicious function pointers and all hidden objects from nine real-world kernel-mode malware samples as well as one created by ourselves, with no false alarms.
Starting Page	555
Ending Page	565
Page Count	11
File Format	PDF
ISBN	9781605588940
DOI	10.1145/1653662.1653729
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2009-11-09
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Kernel integrity Memory analysis Pointer analysis Malware Introspection
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in