文章基本信息

标题：Kernel Code Integrity Protection Based on a Virtualized Memory Architecture
本地全文：下载
作者：Sun, Jianhua ; Chen, Hao ; Chang, Cheng 等
期刊名称：COMPUTING AND INFORMATICS
印刷版ISSN：1335-9150
出版年度：2013
卷号：32
期号：2
页码：295-311
语种：English
出版社：COMPUTING AND INFORMATICS
摘要：Kernel rootkits pose significant challenges on defensive techniques as they run at the highest privilege level along with the protection systems. Modern architectural approaches such as the NX protection have been used in mitigating attacks, however determined attackers can still bypass these defenses with specifically crafted payloads. In this paper, we propose a virtualized Harvard memory architecture to address the kernel code integrity problem, which virtually separates the code fetch and data access on the kernel code to prevent kernel from code modifications. We have implemented the proposed mechanism in commodity operating system, and the experimental results show that our approach is effective and incurs very low overhead.
关键词：Kernel rootkit, security, integrity protection, virtualization, Harvard architecture