LKIM: The Linux Kernel Integrity Measurer
نویسندگان
چکیده
509 he Linux Kernel Integrity Measurer (LKIM) is a next-generation technology for the detection of malicious modifications to a running piece of software. Unlike traditional antivirus systems, LKIM does not rely on a database of known malware signatures; instead, LKIM uses a precise model of expected program behavior to verify the consistency of critical data structures at runtime. APL and the Research Directorate of the National Security Agency (NSA) developed the LKIM prototype and are now working to transition the technology to a variety of critical government applications. LKIM: The Linux Kernel Integrity Measurer
منابع مشابه
Practical Protection of Kernel Integrity for Commodity OS from Untrusted Extensions
Kernel extensions are widely used by attackers to compromise the operating system kernel. With the presence of various untrusted extensions, it remains a challenging problem to comprehensively preserve the integrity of OS kernels in a practical and generic way. In this paper, we present HUKO, a hypervisor-based integrity protection system designed to protect commodity OS kernels from untrusted ...
متن کاملRuntime integrity framework based on trusted computing
I present in this dissertation, a technique to measure the integrity of an operating system, so that the user can verify that all critical software components, including the operating system kernel, is running in a known valid state. The technique solves a key problem of providing continuous runtime verification of kernel memory-space. The measurement is integrated with a trustworthy verificati...
متن کاملAn Application-Oriented Linux Kernel Customization for Embedded Systems
How to reconfigure a general purpose operating system (GPOS) into an embedded operating system has attracted attention for application-specific domains. Linux is currently one of the popular candidates for GPOSs. Although Linux has tools for kernel reconfiguration by letting users add or remove desired function modules, the best schemes of reconfiguring Linux according to a specific embedded sy...
متن کاملShepherding Loadable Kernel Modules through On-demand Emulation
Despite many advances in system security, rootkits remain a threat to major operating systems. First, this paper discusses why kernel integrity verification is not sufficient to counter all types of kernel rootkits and a confidentiality-violation rootkit is demonstrated to evade all integrity verifiers. Then, the paper presents, DARK, a rootkit prevention system that tracks a suspicious loadabl...
متن کاملSILVER: Fine-Grained and Transparent Protection Domain Primitives in Commodity OS Kernel
Untrusted kernel extensions remain one of the major threats to the security of commodity OS kernels. Current containment approaches still have limitations in terms of security, granularity and flexibility, primarily due to the absence of secure resource management and communication methods. This paper presents SILVER, a framework that offers transparent protection domain primitives to achieve f...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 2013