Show simple item record

AuthorSingh, Baljit
AuthorEvtyushkin, Dmitry
AuthorElwell, Jesse
AuthorRiley, Ryan D
AuthorCervesato, Iliano
Available date2020-10-15T10:38:43Z
Publication Date2017
Publication NameASIA CCS 2017 - Proceedings of the 2017 ACM Asia Conference on Computer and Communications Security
ResourceScopus
URIhttp://dx.doi.org/10.1145/3052973.3052999
URIhttp://hdl.handle.net/10576/16473
AbstractRecent work has investigated the use of hardware perfor- mance counters (HPCs) for the detection of malware run- ning on a system. These works gather traces of HPCs for a variety of applications (both malicious and non-malicious) and then apply machine learning to train a detector to dis- tinguish between benign applications and malware. In this work, we provide a more comprehensive analysis of the ap- plicability of using machine learning and HPCs for a specific subset of malware: kernel rootkits. We design five synthetic rootkits, each providing a single piece of rootkit functionality, and execute each while collect- ing HPC traces of its impact on a specific benchmark ap- plication. We then apply machine learning feature selection techniques in order to determine the most relevant HPCs for the detection of these rootkits. We identify 16 HPCs that are useful for the detection of hooking based roots, and also find that rootkits employing direct kernel object manipula- tion (DKOM) do not significantly impact HPCs. We then use these synthetic rootkit traces to train a detection system capable of detecting new rootkits it has not seen previously with an accuracy of over 99%. Our results indicate that HPCs have the potential to be an effective tool for rootkit detection, even against new rootkits not previously seen by the detector.
SponsorThis paper was made possible by NPRP grants 4-1593-1-260 and 8-1474-2-626 from the Qatar National Research Fund (a member of Qatar Foundation). The statements made herein are solely the responsibility of the authors. The authors would also like to thank Aisha Hasan as well as the reviewers for their helpful comments on this work.
Languageen
PublisherAssociation for Computing Machinery, Inc
SubjectHardware performance counters
Intrusion detection
Machine learning
Rootkits
TitleOn the detection of Kernel-level rootkits using hardware performance counters
TypeConference Paper
Pagination483-493
dc.accessType Abstract Only


Files in this item

FilesSizeFormatView

There are no files associated with this item.

This item appears in the following Collection(s)

Show simple item record