By Topic

OPKH: A lightweight online approach to protecting kernel hooks in kernel modules

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

4 Author(s)
Tian Donghai ; Beijing Key Lab. of Software Security Eng. Tech., Beijing Inst. of Technol., Beijing, China ; Li Xuanya ; Hu Changzhen ; Yan Huaizhi

Kernel hooks are very important control data in OS kernel. Once these data are compromised by attackers, they can change the control flow of OS kernel's execution. Previous solutions suffer from limitations in that: 1) some methods require modifying the source code of OS kernel and kernel modules, which is less practical for wide deployment; 2) other methods cannot well protect the kernel hooks and function return addresses inside kernel modules whose memory locations cannot be predetermined. To address these problems, we propose OPKH, an on-the-fly hook protection system based on the virtualization technology. Compared with previous solutions, OPKH offers the protected OS a fully transparent environment and an easy deployment. In general, the working procedure of OPKH can be divided into two steps. First, we utilise the memory virtualization for offline profiling so that the dynamic hooks can be identified. Second, we exploit the online patching technique to instrument the hooks for runtime protection. The experiments show that our system can protect the dynamic hooks effectively with minimal performance overhead.

Published in:

China Communications  (Volume:10 ,  Issue: 11 )