| As operating system kernel integrity is vital important for the security of computer system, how to effectively monitor kernel integrity has become a hot research area in the field of system security. This thesis firstly draws a conclusion by analyzing implementations and features of many kinds of kernel attacks currently exist that four kinds of critical contents — kernel code, kernel data, critical registers and kernel objects — should be monitored intensively, then it proposes a method to monitor kernel integrity based on Intel VT which monitors above four kinds of contents in different ways according to their respective properties.Major contributions and innovations endeavored in this thesis are as follows:1. An EPT-based memory protection mechanism is proposed. This mechanism provides a reliable protection for the integrity of kernel code and some static data by protecting read-only memory pages or partial content of one page. In addition, adopting tight access control to critical registers including CR0, IDTR and GDTR to defense attacks that temper with kernel by modifying these registers, which further enhances the protection for kernel integrity.2. An invariants-based approach for monitoring kernel data integrity is proposed. This method regards kernel data invariants’ states as important evidences that can suggest whether kernel data integrity has been tempered with or not and monitors them by access control or periodically measurement based on their different characteristics, which greatly reduces complexity and increases efficiency to monitor kernel data integrity.3. A real- time method for detecting hidden processes is proposed. The method extracts information of the current process which is scheduled to run when task switched, and then decides whether it is a hidden process or not by cross-view validation. It effectively solves the TOC-TOU problem existed in traditional methods of hidden processes detection. In addition, as hidden processes are mostly realized by tampering with the kernel data or code, the existence of a hidden process generally means that kernel integrity has been tampered with. Therefore, hidden processes detection also can further enhance the ability of monitoring kernel integrity.4. A prototype system Ker Visor, which realizes Linux kernel integrity monitoring is designed and implemented. Experiments and analysis results show that Ker Visor can effectively monitor kernel integrity by detecting or defensing many kinds of attacks which temper with kernel integrity. Meanwhile, Ker Visor introduces a smaller overhead and has a good self- security, and it has a good portability when it is translated between different systems with the same kernel environment. |
