HProve: A Hypervisor Level Provenance System to Reconstruct Attack Story Caused by Kernel Malware

Chonghua Wang,Yang Jiao,Libo Yin,Jun Li,Xiaochun Yun,Rongchao Yin,Xuehong Chen,Zhiyu Hao

doi:10.4108/eai.8-4-2019.157417

Abstract

Provenance of system subjects (e.g., processes) and objects (e.g., ﬁles) are very useful for many forensics tasks. In our analysis and comparison of existing Linux provenance tracing systems, we found that most systems assume the Linux kernel to be in the trust base, making these systems vulnerable

Highlights

Nowadays, enterprises are suffering from rapidly increasing serious attack threats, especially Advanced Persistent Threat (APT)
To validate our experiments results with the ground truth, we have collected 12 kernel malware samples that contain a mix of malicious capabilities found in the wild, including 10 system services hijacking malware, 1 DOH malware, and 1 DKOM malware
Before verifying the effectiveness of HProve, we show that kernel malware could bypass Linux audit utilized by state-of-the-art provenance systems like BEEP [24], LogGC [25], and ProTracer [29]

Summary

Introduction

Enterprises are suffering from rapidly increasing serious attack threats, especially Advanced Persistent Threat (APT). APT attacks are stealthier and more sophisticated by employing multi-step intrusive attacks This kind of attacks would impose disastrous impacts on the systems if the associated attack vector aims at kernel [1,2,3, 6, 7]. To achieve an malicious goal, the kernel-mode components of malware typically employ hooking or DKOM (Direct Kernel Object Manipulation) strategies [4]. The malware hijacks the key functionalities of the operating system such as the system call table, VFS (Virtual File System) functions, or IDT(Interrupt Descriptor Table) and points to malicious functions They are loaded in terms of LKM (Loadable Kernel Module) that have the same privilege of kernel. There are several categories that kernel malware falls into: system service hijacking ( e.g., hooking system call table entries and replacing system call table), dynamic kernel object hooking (KOH, e.g., VFS hooking) and DKOM [36, 40]

Methods

Results

Discussion

Conclusion