Rootkits, which unnoticeably reside in your computer, stealthily carry on remote control and software eavesdropping, are a great threat to network and computer security. It＇s time to acquaint ourselves with their imp...Rootkits, which unnoticeably reside in your computer, stealthily carry on remote control and software eavesdropping, are a great threat to network and computer security. It＇s time to acquaint ourselves with their implement and detection. This article pays more attention to kernel rootkits, because they are more difficult to compose and to be identified than useland rootkits. The latest technologies used to write and detect kernel rootkits, along with their advantages and disadvantages.展开更多
Hardware Trojan(HT) refers to a special module intentionally implanted into a chip or an electronic system. The module can be exploited by the attacker to achieve destructive functions. Unfortunately the HT is difficu...Hardware Trojan(HT) refers to a special module intentionally implanted into a chip or an electronic system. The module can be exploited by the attacker to achieve destructive functions. Unfortunately the HT is difficult to detecte due to its minimal resource occupation. In order to achieve an accurate detection with high efficiency, a HT detection method based on the electromagnetic leakage of the chip is proposed in this paper. At first, the dimensionality reduction and the feature extraction of the electromagnetic leakage signals in each group(template chip, Trojan-free chip and target chip) were realized by principal component analysis(PCA). Then, the Mahalanobis distances between the template group and the other groups were calculated. Finally, the differences between the Mahalanobis distances and the threshold were compared to determine whether the HT had been implanted into the target chip. In addition, the concept of the HT Detection Quality(HTDQ) was proposed to analyze and compare the performance of different detection methods. Our experiment results indicate that the accuracy of this detection method is 91.93%, and the time consumption is 0.042s in average, which shows a high HTDQ compared with three other methods.展开更多
Traffic hijacking is a common attack perpetrated on networked systems, where attackers eavesdrop on user transactions, manipulate packet data, and divert traffic to illegitimate locations. Similar attacks can also be ...Traffic hijacking is a common attack perpetrated on networked systems, where attackers eavesdrop on user transactions, manipulate packet data, and divert traffic to illegitimate locations. Similar attacks can also be unleashed in a NoC (Network on Chip) based system where the NoC comes from a third-party vendor and can be engrafted with hardware Trojans. Unlike the attackers on a traditional network, those Trojans are usually small and have limited capacity. This paper targets such a hardware Trojan;Specifically, the Trojan aims to divert traffic packets to unauthorized locations on the NoC. To detect this kind of traffic hijacking, we propose an authentication scheme in which the source and destination addresses are tagged. We develop a custom design for the packet tagging and authentication such that the implementation costs can be greatly reduced. Our experiments on a set of applications show that on average the detection circuitry incurs about 3.37% overhead in area, 2.61% in power, and 0.097% in performance when compared to the baseline design.展开更多
Because of the widespread of Trojans,organizations and Internet users become more vulnerable to the threat of information leakage.This paper describes an information leakage detection system( ILDS) to detect sensitive...Because of the widespread of Trojans,organizations and Internet users become more vulnerable to the threat of information leakage.This paper describes an information leakage detection system( ILDS) to detect sensitive information leakage caused by Trojan.In particular,the principles of the system are based on the analysis of net-flows in four perspectives: heartbeat behavior analysis,DNS abnormal analysis,uploaddownload ratio and content analysis.Heartbeat behavior analysis and DNS abnormal analysis are used to detect the existence of Trojans while upload-download ratio and content analysis can quickly detect when the information leakage happens.Experiments indicate that the system is reliable and efficient in detecting information leakage.The system can also help to collect and preserve digital evidence when information leakage incident occurs.展开更多
基金Supported by the Key Scientific and TechnologicalProject of Henan Province (SP200402089)
文摘Rootkits, which unnoticeably reside in your computer, stealthily carry on remote control and software eavesdropping, are a great threat to network and computer security. It＇s time to acquaint ourselves with their implement and detection. This article pays more attention to kernel rootkits, because they are more difficult to compose and to be identified than useland rootkits. The latest technologies used to write and detect kernel rootkits, along with their advantages and disadvantages.
基金supported by the Special Funds for Basic Scientific Research Business Expenses of Central Universities No. 2014GCYY0the Beijing Natural Science Foundation No. 4163076the Fundamental Research Funds for the Central Universities No. 328201801
文摘Hardware Trojan(HT) refers to a special module intentionally implanted into a chip or an electronic system. The module can be exploited by the attacker to achieve destructive functions. Unfortunately the HT is difficult to detecte due to its minimal resource occupation. In order to achieve an accurate detection with high efficiency, a HT detection method based on the electromagnetic leakage of the chip is proposed in this paper. At first, the dimensionality reduction and the feature extraction of the electromagnetic leakage signals in each group(template chip, Trojan-free chip and target chip) were realized by principal component analysis(PCA). Then, the Mahalanobis distances between the template group and the other groups were calculated. Finally, the differences between the Mahalanobis distances and the threshold were compared to determine whether the HT had been implanted into the target chip. In addition, the concept of the HT Detection Quality(HTDQ) was proposed to analyze and compare the performance of different detection methods. Our experiment results indicate that the accuracy of this detection method is 91.93%, and the time consumption is 0.042s in average, which shows a high HTDQ compared with three other methods.
文摘Traffic hijacking is a common attack perpetrated on networked systems, where attackers eavesdrop on user transactions, manipulate packet data, and divert traffic to illegitimate locations. Similar attacks can also be unleashed in a NoC (Network on Chip) based system where the NoC comes from a third-party vendor and can be engrafted with hardware Trojans. Unlike the attackers on a traditional network, those Trojans are usually small and have limited capacity. This paper targets such a hardware Trojan;Specifically, the Trojan aims to divert traffic packets to unauthorized locations on the NoC. To detect this kind of traffic hijacking, we propose an authentication scheme in which the source and destination addresses are tagged. We develop a custom design for the packet tagging and authentication such that the implementation costs can be greatly reduced. Our experiments on a set of applications show that on average the detection circuitry incurs about 3.37% overhead in area, 2.61% in power, and 0.097% in performance when compared to the baseline design.
基金Sponsored by the National Natural Science Foundation of China(Grant No.61272500)the National High Technology Research and Development Program of China(Grant No.2011AA010701)
文摘Because of the widespread of Trojans,organizations and Internet users become more vulnerable to the threat of information leakage.This paper describes an information leakage detection system( ILDS) to detect sensitive information leakage caused by Trojan.In particular,the principles of the system are based on the analysis of net-flows in four perspectives: heartbeat behavior analysis,DNS abnormal analysis,uploaddownload ratio and content analysis.Heartbeat behavior analysis and DNS abnormal analysis are used to detect the existence of Trojans while upload-download ratio and content analysis can quickly detect when the information leakage happens.Experiments indicate that the system is reliable and efficient in detecting information leakage.The system can also help to collect and preserve digital evidence when information leakage incident occurs.
