Study on Information Security Monitoring Framework

Abstract

As malware has become increasingly sophisticated over the past several years, it is no longer unusual to see it disable critical security services on a victims machine. In our threat model, we assume the attacker can compromise the users OS and any application running inside it. The results show that our threat model makes an introspection assumption stating that the OS and application level data structures in the User VM memory have not been altered, it is still instructive to consider what it would take to perform this type of attack, and the most security critical data is located in the User OS kernel.