NDLI: JoKER: Trusted Detection of Kernel Rootkits in Android Devices via JTAG Interface

Content Provider	IEEE Xplore Digital Library
Author	Guri, M. Poliak, Y. Shapira, B. Elovici, Y.
Copyright Year	2015
Description	Author affiliation: Dept. of Inf. Syst. Eng., Telekom Innovation Labs. at Ben-Gurion Univ., Beer-Sheva, Israel (Shapira, B.; Elovici, Y.) \|\| Dept. of Inf. Syst. Eng., Ben-Gurion Univ., Beer-Sheva, Israel (Guri, M.; Poliak, Y.)
Abstract	Smartphones and tablets have become prime targets for malware, due to the valuable private and corporate information they hold. While Anti-Virus (AV) program may successfully detect malicious applications (apps), they remain ineffective against low-level rootkits that evade detection mechanisms by masking their own presence. Furthermore, any detection mechanism run on the same physical device as the monitored OS can be compromised via application, kernel or boot-loader vulnerabilities. Consequentially, trusted detection of kernel rootkits in mobile devices is a challenging task in practice. In this paper we present 'JoKER' - a system which aims at detecting rootkits in the Android kernel by utilizing the hardware's Joint Test Action Group (JTAG) interface for trusted memory forensics. Our framework consists of components that extract areas of a kernel's memory and reconstruct it for further analysis. We present the overall architecture along with its implementation, and demonstrate that the system can successfully detect the presence of stealthy rootkits in the kernel. The results show that although JTAG's main purpose is system testing, it can also be used for malware detection where traditional methods fail.
Starting Page	65
Ending Page	73
File Size	573142
Page Count	9
File Format	PDF
e-ISBN	9781467379526
DOI	10.1109/Trustcom.2015.358
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-08-20
Publisher Place	Finland
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Trusted Detection JTAG Forensics Humanoid robots Random access memory Malware Mobile handsets Androids Security Kernel Rootkits Android
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

JoKER: Trusted Detection of Kernel Rootkits in Android Devices via JTAG Interface

Android Malware Forensics: Reconstruction of Malicious Events

Kernel-based Behavior Analysis for Android Malware Detection

Efficient memory reclaiming for mitigating sluggish response in mobile devices

Mobile malware security challeges and cloud-based detection

Analysis of Features Selection and Machine Learning Classifier in Android Malware Detection

Adware detection and privacy control in mobile devices

Detection and Identification of Android Malware Based on Information Flow Monitoring

Dump and analysis of Android volatile memory on Wechat

JoKER: Trusted Detection of Kernel Rootkits in Android Devices via JTAG Interface

Similar Documents

JoKER: Trusted Detection of Kernel Rootkits in Android Devices via JTAG Interface

Android Malware Forensics: Reconstruction of Malicious Events

Kernel-based Behavior Analysis for Android Malware Detection

Efficient memory reclaiming for mitigating sluggish response in mobile devices

Mobile malware security challeges and cloud-based detection

Analysis of Features Selection and Machine Learning Classifier in Android Malware Detection

Adware detection and privacy control in mobile devices

Detection and Identification of Android Malware Based on Information Flow Monitoring

Dump and analysis of Android volatile memory on Wechat

JoKER: Trusted Detection of Kernel Rootkits in Android Devices via JTAG Interface