CT-ISG: Advanced Techniques to Detect Kernel-Level Rootkits

商业操作系统内核的完整性受到rootkit的威胁，rootkit修改关键的内核数据结构，以实现各种恶意目标。虽然历史上rootkit被认为会影响内核中的控制数据，但最近的工作表明rootkit通过修改非控制数据来影响系统安全，例如用于管理簿记信息的链表和用于内存管理的元数据。现有的技术无法有效地检测这样的rootkit。本项目正在开发技术，以提供实时保护againstrootkit通过检测异常在控制和非控制内核数据库或使用自动生成的完整性规范。这一目标分两步实现。 首先，开发了一种挖掘内核数据结构完整性规范的技术。这些规范作为数据结构不变量被自动地挖掘出来。 第二，这些技术正在扩展使用操作系统的支持，以提供实时detection.Impacts和结果：在这个项目中开发的技术将对下一代rootkit的攻击，并将使实时检测ofsuch rootkit。 此外，推断内核不变量的技术也可以在操作系统可靠性、容错和软件工程中找到应用。项目执行人将通过发布所开发的工具来传播结果。 该项目的成果将为员工配备一个跨学科的工具包，该工具包将操作系统、计算机安全和软件工程结合起来，以应对下一代隐形恶意软件带来的挑战。

The integrity of commodity operating system kernels is threatened by rootkitsthat modify key kernel data structures to achieve a variety of malicious goals.While rootkits have historically been known to affect control data in thekernel, recent work demonstrates rootkits that affect system security bymodifying non-control data, such as linked lists used to manage bookkeepinginformation and metadata used for memory management. Existing techniques failto detect such rootkits effectively.This project is developing techniques to provide real-time protection againstrootkits by detecting anomalies in both control and non-control kernel databehavior using automatically-generated integrity specifications. This goal isbeing achieved in two steps. First, a technique to mine specifications ofkernel data structure integrity is being developed. These specifications are bemined automatically as data structure invariants. Second, these techniques arebeing extended using operating system support to provide real-time detection.Impacts and Results: The techniques developed in this project will defendagainst the next generation of rootkits, and will enable real-time detection ofsuch rootkits. In addition, techniques to infer kernel invariants may also find applications in operating system reliability, fault tolerance andsoftware engineering. The PIs will disseminate the results by releasing the tools developed. The results of this project will equip the workforce with aninter-disciplinary toolkit, that combines operating systems, computer security,and software engineering, to address the challenges posed by the nextgeneration of stealth malware.