论文部分内容阅读
为了监控内核模块rootkit的行为,提出一种基于硬件辅助虚拟化的虚拟机内核模块隔离框架,采用两套硬件辅助页表技术实现不可信模块与内核的隔离运行,并使用一种基于栈帧基地址链的方法保护内核堆栈的完整性.在KVM(基于内核的虚拟机)全虚拟化环境下实现了虚拟机内核模块隔离运行的原型系统Hyper-ISO(超级隔离).实验结果表明:Hyper-ISO可以实时监控不可信模块与内核之间的控制转移过程、不可信模块对内核代码与数据的访问序列,并保护内核堆栈在模块运行期间不被模块恶意修改.
In order to monitor the behavior of kernel module rootkit, this paper proposes a virtual machine kernel module isolation framework based on hardware-assisted virtualization. Two sets of hardware-assisted page table technologies are used to realize the isolated operation of the untrusted module and the kernel. Address chain to protect the integrity of the kernel stack Hyper-ISO (Hyper-Iso), a prototype system for isolating virtual machine kernel modules, is implemented under full virtualization of KVM (Kernel-based Virtual Machine) .Experimental results show that Hyper- The ISO can monitor the control transfer process between the untrusted module and the kernel in real time, the access sequence of the untrusted module to the kernel code and data, and protect the kernel stack from being maliciously modified by the module during the operation of the module.