On the detection of Kernel-level rootkits using hardware performance counters
المؤلف | Singh, Baljit |
المؤلف | Evtyushkin, Dmitry |
المؤلف | Elwell, Jesse |
المؤلف | Riley, Ryan D |
المؤلف | Cervesato, Iliano |
تاريخ الإتاحة | 2020-10-15T10:38:43Z |
تاريخ النشر | 2017 |
اسم المنشور | ASIA CCS 2017 - Proceedings of the 2017 ACM Asia Conference on Computer and Communications Security |
المصدر | Scopus |
الملخص | Recent work has investigated the use of hardware perfor- mance counters (HPCs) for the detection of malware run- ning on a system. These works gather traces of HPCs for a variety of applications (both malicious and non-malicious) and then apply machine learning to train a detector to dis- tinguish between benign applications and malware. In this work, we provide a more comprehensive analysis of the ap- plicability of using machine learning and HPCs for a specific subset of malware: kernel rootkits. We design five synthetic rootkits, each providing a single piece of rootkit functionality, and execute each while collect- ing HPC traces of its impact on a specific benchmark ap- plication. We then apply machine learning feature selection techniques in order to determine the most relevant HPCs for the detection of these rootkits. We identify 16 HPCs that are useful for the detection of hooking based roots, and also find that rootkits employing direct kernel object manipula- tion (DKOM) do not significantly impact HPCs. We then use these synthetic rootkit traces to train a detection system capable of detecting new rootkits it has not seen previously with an accuracy of over 99%. Our results indicate that HPCs have the potential to be an effective tool for rootkit detection, even against new rootkits not previously seen by the detector. |
راعي المشروع | This paper was made possible by NPRP grants 4-1593-1-260 and 8-1474-2-626 from the Qatar National Research Fund (a member of Qatar Foundation). The statements made herein are solely the responsibility of the authors. The authors would also like to thank Aisha Hasan as well as the reviewers for their helpful comments on this work. |
اللغة | en |
الناشر | Association for Computing Machinery, Inc |
الموضوع | Hardware performance counters Intrusion detection Machine learning Rootkits |
النوع | Conference Paper |
الصفحات | 483-493 |
الملفات في هذه التسجيلة
الملفات | الحجم | الصيغة | العرض |
---|---|---|---|
لا توجد ملفات لها صلة بهذه التسجيلة. |
هذه التسجيلة تظهر في المجموعات التالية
-
علوم وهندسة الحاسب [2288 items ]