Sciweavers

Share
RAID
2010
Springer

Kernel Malware Analysis with Un-tampered and Temporal Views of Dynamic Kernel Memory

8 years 5 months ago
Kernel Malware Analysis with Un-tampered and Temporal Views of Dynamic Kernel Memory
Dynamic kernel memory has been a popular target of recent kernel malware due to the difficulty of determining the status of volatile dynamic kernel objects. Some existing approaches use kernel memory mapping to identify dynamic kernel objects and check kernel integrity. The snapshot-based memory maps generated by these approaches are based on the kernel memory which may have been manipulated by kernel malware. In addition, because the snapshot only reflects the memory status at a single time instance, its usage is limited in temporal kernel execution analysis. We introduce a new runtime kernel memory mapping scheme called allocation-driven mapping, which systematically identifies dynamic kernel objects, including their types and lifetimes. The scheme works by capturing kernel object allocation and deallocation events. Our system provides a number of unique benefits to kernel malware analysis: (1) an un-tampered view wherein the mapping of kernel data is unaffected by the manipulati...
Junghwan Rhee, Ryan Riley, Dongyan Xu, Xuxian Jian
Added 30 Jan 2011
Updated 30 Jan 2011
Type Journal
Year 2010
Where RAID
Authors Junghwan Rhee, Ryan Riley, Dongyan Xu, Xuxian Jiang
Comments (0)
books