基于虚拟机架构的内核Rootkit防范方案

Virtual machine based method to prevent kernel Rootkits

内核Rootkit是运行在操作系统内核空间的恶意程序,对系统安全构成巨大威胁。研究表明,内核Rootkit的共同特征是修改内核的程序控制流程。分析了Linux内核中影响程序控制流程的资源,并通过对这些资源进行保护,来防止Rootkit对内核控制流程的篡改。实验表明,该方法能够有效防止多种Rootkit对Linux内核的攻击。

Kernel Rootkit runs in the kernel space of the operating system and is a huge threat to the security of computer system.Previous research shows that nearly all Rootkits modify the control flow of the OS kernel.The paper identifies the resources which affect kernel control flow in Linux.By protecting these resources in the OS kernel,the kernel control flow can be prevented from being compromised.Experiments show that this method can effectively defend against a variety of Linux kernel Rootkits.