Kernel Module Research Articles

Cyber situation perception for Internet of Things systems based on zero‐day attack activities recognition within advanced persistent threat

SummaryWith the development of the Internet of Things (IoT) technology, various attacks and threats have emerged. The advanced persistent threat (APT) refers to a class of advanced multiple‐steps attacks among diverse attack activities, which brings severe threats to the IoT systems ascribe to its pertinence, concealment, and permeability. However, the existing technologies and methods fail to timely recognize the APT attack activities (especially the zero‐day exploits) in a comprehensive scope. To address this problem, we propose a novel method of cyber situation perception for IoT systems, which based on zero‐day attack activity recognition within APT (CSPAPTM). Moreover, we also design an edge computing framework for applying CSPAPTM to the typical IoT systems. Specifically, we first provide a cyber situation perception ontology construction module for describing the APT attack activities. Then, a malicious C&C DNS mining method (MCCDRM) is proposed to control the APT malicious activity correlation analysis trigger, which can effectively decrease the computing overhead. Finally, we propose a zero‐day attack activity recognition method within APT (ZDAARA), which acts on system call instances to recognize the malicious activities, which cannot be detected by IDS. A relatively mature access control mechanism PO‐SAAC is also applied to our method. Through the coalescent of these methods, CSPAPTM can accomplish the cyber situation perception effectively by the zero‐day attack activities recognition in the IoT systems. The exhaustive experimental results demonstrate that the two kernel modules, that is, MCCDRM and ZDAARA in our CSPAPTM, can achieve both higher F1 score and acceptable false positive rate.

VoltJockey: A New Dynamic Voltage Scaling-Based Fault Injection Attack on Intel SGX

Intel software guard extensions (SGX) increase the security of applications by enabling them to be performed in a highly trusted space (called enclave). Most state-of-the-art attacks on SGX focus on either mining the software vulnerabilities in the enclave or speculating the secret data with side channels. In this study, we report our recent work on breaking SGX by inducing voltage-oriented hardware faults. The novelty and importance of this attack are that it is completely controlled by software and does not require any security vulnerability in the software. Our proposed attack, called VoltJockey, exploits a vulnerability in the implementation of dynamic voltage and frequency scaling (DVFS) that achieves energy saving by dynamically adjusting the processor's operating voltage and thus clock frequency. However, if the operating voltage is lower than a certain critical level, the circuit's timing constraint will fail and hardware fault would be created. We propose to deliberately trigger such voltage-oriented hardware faults by a loadable kernel module that can set the processor's voltage through Intel's undocumented model-specific register (MSR). We first utilize the module to furnish the processor with a transient low voltage with controlled timing to inject a temporal fault into the target location of the program running in the enclave. Then, we perform a differential fault attack on the outputs before and after the injection of faults. For demonstration, we successfully deploy the proposed attack to extract the key of an AES executed in the enclave and lead an SGX-protected RSA to output our specified result.

XTSeH: A Trusted Platform Module Sharing Scheme Towards Smart IoT-eHealth Devices

IoT based eHealth system brings a revolution to healthcare industry, with which the old healthcare systems can be updated into smarter and more personalized ones. The practitioners can continue monitoring the physical status of the patients at anytime and anywhere, and develop more precise treatment plans by analyzing the collected data, such as heart rate, blood pressure, blood glucose. Actually, these smart sensors used in eHealth system are smart embedded devices (SED). Due to the limitations on hardware capabilities, these inter-connected SEDs lack of security considerations in design and implementation, and face the threats from the network. To prevent the malicious users (or programs) from tampering with the SEDs, trusted platform module (TPM) is adopted, which can guarantee the system integrity via detecting unauthorized modifications to data and system environment. However, due to the limited scalability and insufficient system resources, not all SEDs can be deployed with TPM chips. To address this issue, in this paper, a TPM extension scheme (xTSeH) is proposed. In xTSeH, we have extended the functions of a TPM deployed in a SED (TSED) to those non-TPM-protected SEDs (N-TSED) via network. A shadow TPM in the form of a kernel module is designed as the trust base for the N-TSED, which is the representative of the TPM in TSED. Then, three protocols are proposed to implement the integrity verification and inter-SED authentication. Finally, a Raspberry Pi based prototype system is designed and implemented. The feasibility and usability of our scheme are proved by the analysis of the experimental results of system performance.

Virtual Wall: Filtering Rootkit Attacks To Protect Linux Kernel Functions

Linux servers are being used in almost all clouds, datacenters and supercomputers today. Linux Kernel functions are facing a kind of malware attacks, known as rootkits with root-access capability. The rootkits appear as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">loadable kernel modules</i> (LKM) in today's Linux servers. These modules hide from other kernel objects, and can redirect the kernel control flow by tampering with the metadata needed in kernel service functions. The kernel rootkits are invisible to users after loading, which may bypass most security shields. Both spatial and temporal appearance of rootkits are randomly distributed, which makes it difficult to detect or removal. To deal with rootkit threats, we propose a novel <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Virtual Wall</i> (VTW) approach to filtering out the rootkit-embedded LKMs by tracing the incurred kernel activities. This VTW is essentially a lightweight hypervisor built with rootkit detection and event tracing capabilities. Normally, the Linux runs in a guest mode. When a LKM execution violates the security policy set by the VTW, the OS control will switch to a host mode. The VTW at host mode enables the detection and tracing of rootkit events timely. In other words, potential rootkit attacks are detected, traced and classified to make meaningful filtering decisions. The whole detection and tracing process is based on memory access control and event injection mechanisms. Experimental results show that the VTW defense system is effective to detect and defend against kernel rootkits timely. The CPU overhead for executing VTW is less than 2 percent. Compared with other defense schemes (such as DIKernel, etc.), our vs is easier to implement with low performance degradation on Linux servers. We will demonstrate the advantages of VTW through its simplicity in implementation and potential performance gains. We will also compare our system with seven other rootkit defense systems.

Internet‐of‐Things‐Infrastructure‐as‐a‐Service: The democratization of access to public Internet‐of‐Things Infrastructure

SummaryWe propose a new cloud service model called Internet‐of‐Things (IoT)‐Infrastructure‐as‐a‐Service (IoT‐IaaS). Under an IoT‐IaaS, an IaaS cloud service provider can go beyond offering IoT data streams and offer access to IoT infrastructure to users, the same way data center infrastructure is shared in the IaaS model. We developed a reference design for the proposed IoT‐IaaS cloud service model, built from open source components. We demonstrate the proposed reference design in the form of a virtualized‐IoT (vIoT) testbed. The vIoT testbed uses the OpenStack cloud management system and Raspberry Pi embedded computers (standing in for IoT devices) configured as Nova‐compute nodes and LXD containers. We also developed a simple mechanism for shared access to high data rate sensors (a camera) and low data rate sensors (temperature‐humidity) by multiple tenants. We tested the performance of container launch times, memory access (with and without ZRAM optimization kernel module enabled), CPU, and file I/O for applications running inside Linux containers and compared it with the same performance when running on the Raspberry Pi's host OS. We conclude that there is no significant performance penalty for executing the edge component of an IoT application inside a Linux container, rather than directly on the device's host OS.

Lightweight and Efficient Hypervisor-Based Dynamic Binary Instrumentation and Analysis Method

At present, various vulnerabilities and malicious programs are still constantly threatening the system security, and in-depth analysis of legitimate applications and malicious code is an important link of security defense under the current security situation. Dynamic binary analysis is the important method in the field of binary analysis, and after years of research and development, many valuable results have been achieved, and some mature tools generated have been widely used in practice. But it still faces multiple challenges in terms of analysis efficiency, deployment, and the impact on the target program. Based on the existing research, this article proposes a new lightweight hypervisor-based dynamic binary instrumentation method, which uses the virtualization features of new processors to perform transparent and efficient execution interception of the target program, so that it can instrument the target program and redirect the original execution. To take full advantage of the interception solution, we further present a compact inline dynamic taint analysis method that enables fine-grained data flow analysis of the target program with multiple processes and kernel modules. Experiments in the real environment show that the proposed method is effective and efficient in the binary instrumentation and analysis, it can achieve a good balance in analysis performance, availability and stealthiness, and can be applied to the practical analysis scenarios.

A Novel Deep Learning Approach for Machinery Prognostics Based on Time Windows

Remaining useful life (RUL) prediction is a challenging research task in prognostics and receives extensive attention from academia to industry. This paper proposes a novel deep convolutional neural network (CNN) for RUL prediction. Unlike health indicator-based methods which require the long-term tracking of sensor data from the initial stage, the proposed network aims to utilize data from consecutive time samples at any time interval for RUL prediction. Additionally, a new kernel module for prognostics is designed where the kernels are selected automatically, which can further enhance the feature extraction ability of the network. The effectiveness of the proposed network is validated using the C-MAPSS dataset for aircraft engines provided by NASA. Compared with the state-of-the-art results on the same dataset, the prediction results demonstrate the superiority of the proposed network.

Cyber Situation Comprehension for IoT Systems based on APT Alerts and Logs Correlation.

With the emergence of the Advanced Persistent Threat (APT) attacks, many Internet of Things (IoT) systems have faced large numbers of potential threats with the characteristics of concealment, permeability, and pertinence. However, existing methods and technologies cannot provide comprehensive and prompt recognition of latent APT attack activities in the IoT systems. To address this problem, we propose an APT Alerts and Logs Correlation Method, named APTALCM and a framework of deploying APTALCM on the IoT system, where an edge computing architecture was used to achieve cyber situation comprehension without too much data transmission cost. Specifically, we firstly present a cyber situation ontology for modeling the concepts and properties to formalize APT attack activities in the IoT systems. Then, we introduce a cyber situation instance similarity measurement method based on the SimRank mechanism for APT alerts and logs Correlation. Combining with instance similarity, we further propose an APT alert instances correlation method to reconstruct APT attack scenarios and an APT log instances correlation method to detect log instance communities. Through the coalescence of these methods, APTALCM can accomplish the cyber situation comprehension effectively by recognizing the APT attack intentions in the IoT systems. The exhaustive experimental results demonstrate that the two kernel modules, i.e., Alert Instance Correlation Module (AICM) and Log Instance Correlation Module (LICM) in our APTALCM, can achieve both high true-positive rate and low false-positive rate.

DALI LED Driver Control System for Lighting Operations Based on Raspberry Pi and Kernel Modules

Light emitting diodes (LEDs) as an efficient low-consumption lighting technology are being used increasingly in many applications. The move to LED lighting is also changing the way the lighting control systems are designed. Currently, most electronic ballasts and other digital lighting devices implement the Digital Addressable Lighting Interface (DALI) standard. This paper presents a low-cost, low-power effective DALI LED driver controller, based on open-source Raspberry Pi3 microcontroller prototyping platform. The control software is developed as a Linux kernel module under UBUNTU 18.04.2 LTS patched with PREEMPT_RT (Preemptive Real-time) for real-time processing. This dynamically loaded kernel module performs all the processing, communication and control operations of the Raspberry Pi3-based DALI controller with the DALI LED driver and LED luminaire. Software applications written in C and Python were developed for performance testing purposes. The experimental results showed that the proposed system could efficiently and effectively manage DALI LED drivers and perform lighting operations (e.g. dimming). The system can be used for a variety of purposes from personal lighting control needs and experimental research in control of electronic ballasts and other control gears, devices and sensors, to advanced requirements in professional buildings, including energy management, lighting maintenance and usage.

Study on Optimization of automatic train operation based on Grey genetic algorithm

The speed controller is the kernel module of Automatic Train Operation system, and is also a key core technology of the intelligent high-speed train. The research of the intelligent speed controller of ATO system is of great significance for automatic high-speed train operation. Through the analysis of the principle and function of CTCS-3 system, the scheme of adding the speed controller of ATO system in CTCS-3 system was proposed. The connection way between the speed controller of ATO system and ground equipment was designed to realize information interaction. The model of speed controller of ATO system for high-speed trains which is researched by grey system theory was used for prediction and decision making. In the grey prediction module, the metabolic GM (1,1) model was established, and the optimal strategy was generated by the multi-objective intelligent weighted grey target decision. Finally, a reasonable control strategy of train automatic operation was obtained. The optimal control strategy was got by using genetic algorithm. Designing software for the simulation test, the simulation results show that the method achieves automatic high-speed train operation under the CTCS-3+ATO system through the actual line data, and the efficiency of train operation, the energy saving index and all the performance indexes of the train were improved.

Rendering differential performance preference through intelligent network edge in cloud data centers

SummarySharing the network infrastructure, the performance of emerging distributed applications and services in data centers is directly impacted by the network. As these applications are becoming more and more demanding, it is challenging to satisfy their requirements of low latency, high throughput, and low packet loss rate simultaneously. Prior approaches typically resort to flow control or scheduling mechanisms, prioritizing flows according to their demands. However, none of the methods can solely satisfy the various demands of data center applications. Addressing this challenge, we propose tasch, a preference aware flow scheduling mechanism equipped in the software network edge (ie, end‐host networking). This mechanism utilizes multiple separate queues for flows with different preferences, which guarantees low packet delay for latency‐sensitive flows and provides bandwidth guarantees for throughput‐sensitive flows. A coordinating algorithm is presented to share the network resource among multiple queues with pareto‐optimality. tasch is implemented as a thin and plugable kernel module in Linux based hypervisors, which lies between the complicated physical network and tenants VMs. Subsequently, based on the flow traces of real‐world applications, extensive experiments were conducted to verify the effectiveness of network management mechanism.

Optimization Implementation of SM3 Algorithm Based on 64 Rounds Grading Calculation

This electronic document analyzes the calculation process of SM3 algorithm and finds that the iterative compression process is suitable for optimizing and improving with the characteristics of hardware. Therefore, a parallel implementation strategy of running water line and computing is proposed during the iterative compression process. This strategy makes full use of the hardware’s parallel features, making the SM3 algorithm the most complex and time-consuming. In the 64-wheel calculation project, it is possible to allow successively entered data to be calculated in different rounds at the same time. In the case of continuous large traffic data, the computational efficiency is greatly improved, and the delay is reduced, and there is no case where the calculation module waits for data. This allows computing resources to be used efficiently. The delay can be as low as 0 at 125 MHz clock. 008μs. in addition, the parallel mode of multiple algorithm kernel modules is used to make the algorithm kernel become a relatively independent module, which greatly increases the scalability of the performance.

Augmenting Operating Systems with OpenCL Accelerators

Heterogeneous computing leverages more than one kind of processors to boost the performance of user-space applications with the heterogeneous programming languages, e.g., OpenCL. While some works have been done to accelerate the computations required by Linux kernel software, they are either application-specific solutions or tightly coupled with the certain computing platforms and are not able to support the general-purpose in-kernel accelerations using different types of processors. In this article, the general-purpose software framework called Kernel acceleration with OpenCL (KOCL), is proposed to tackle the problem. KOCL exposes a set of the high-level programming interfaces for the Linux kernel module developers to offload compute-intensive tasks on different hardware accelerators without managing and coordinating the platform-specific computing and memory resources. The simplified programming efforts are achieved by the developed platform management and memory models, which provide a systematic means of managing the heterogeneous hardware resources. In addition, the one- and zero-copy data-buffering schemes are offered by KOCL, so that the offloaded tasks deliver high performance on the platforms with different memory architectures. We have developed the prototype system to accelerate the Network-Attached Storage server applications. Significant performance improvements are achieved with the three different types of accelerators, i.e., the multicore processor, the integrated GPU, and the discrete GPU, respectively. We believe that KOCL is useful for the design of embedded appliances to evaluate the performance of design alternatives.

Nonvolatile kernel rootkit detection using cross‐view clean boot in cloud computing

SummaryMalware attacks on kernel rootkits have become increasingly sophisticated and extremely difficult to detect; hence, they have a reign of power over the functionalities of the kernel. These kernel rootkits adopt stealth techniques to conceal the system processes, kernel modules, and other control structures, making it quite a challenge to detect their presence in the victim system. Many current efforts to detect the rootkits are based on known sources and are primarily system specific and hence are ineffective for newly mutating, hidden, and unknown rootkits. Therefore, in this paper, a kernel rootkit hidden file detection view (KRHFDV) system is proposed to detect such rootkits by identifying hidden files. This detection process uses a cross‐view clean‐boot‐based approach and defines a process monitoring framework that continuously maintains a list of active files and can detect both known and unknown rootkits with minimal performance overhead. KRHFDV overcomes the semantic gap by intercepting system call events of the tainted operating system in a nonintrusive manner and monitors the kernel to reconstruct a semantic‐level process information structure. The results from the extensive performance evaluation carried out with 64 rootkit samples in a cloud environment for both Linux and Windows kernels show that KRHFDV is able to identify file hiding behaviours of all samples in the least detection time.

CustEM: Customizable finite-element simulation of complex controlled-source electromagnetic data

We have developed the open-source toolbox custEM (customizable electromagnetic modeling) for the simulation of complex 3D controlled-source electromagnetic (CSEM) problems. It is based on the open-source finite-element library FEniCS, which supports tetrahedral meshes, multiprocessing, higher order polynomials, and anisotropy. We use multiple finite-element approaches to solve the time-harmonic Maxwell equations, which are based on total or secondary electric field and gauged potential formulations. In addition, we develop a secondary magnetic field formulation, showing superior performance if only magnetic fields are required. Using Nédélec basis functions, we robustly incorporate the current density on the edges of the mesh for the total field formulations. The latter enable modeling of CSEM problems taking topography into account. We evaluate semianalytical 1D layered-earth solutions with the pyhed library, supporting arbitrary configurations of dipole or loop sources for secondary field calculations. All system matrices have been modified to be symmetric and solved in parallel with the direct solver MUMPS. Aside from the finite-element kernel, mesh generation, interpolation, and visualization modules have been implemented to simplify and automate the modeling workflow. We prove the capability of custEM, including validation against analytic-solutions, crossvalidation of all implemented approaches, and results for a model with 3D topography with four examples. The object-oriented implementation allows for customizable modifications and additions or to use only submodules designed for special tasks, such as mesh generation or matrix assembly. Therefore, the toolbox is suitable for crossvalidation with other codes and as the basis for developing 3D inversion routines.

A Kernel Rootkit Detection Approach Based on Virtualization and Machine Learning

OS kernel is the core part of the operating system, and it plays an important role for OS resource management. A popular way to compromise OS kernel is through a kernel rootkit (i.e., malicious kernel module). Once a rootkit is loaded into the kernel space, it can carry out arbitrary malicious operations with high privilege. To defeat kernel rootkits, many approaches have been proposed in the past few years. However, existing methods suffer from some limitations: 1) most methods focus on user-mode rootkit detection; 2) some methods are limited to detect obfuscated kernel modules; and 3) some methods introduce significant performance overhead. To address these problems, we propose VKRD, a kernel rootkit detection system based on the hardware assisted virtualization technology. Compared with previous methods, VKRD can provide a transparent and an efficient execution environment for the target kernel module to reveal its run-time behavior. To select the important run-time features for training our detection models, we utilize the TF-IDF method. By combining the hardware assisted virtualization and machine learning techniques, our kernel rootkit detection solution could be potentially applied in the cloud environment. The experiments show that our system can detect windows kernel rootkits with high accuracy and moderate performance cost.

Ін’єктивний метод отримання даних користувацького досвіду в ігрових симуляторах комп’ютерних мереж

In the paper the ways of organizing the simulator’s work of computer networks are described, as well as methods and approaches for harvesting user experience. The application of this technology for entertainment and educational purposes is described. The main goals of collecting user data in gaming simulators of computer networks, which are used in particular in the competitions and contests for programming and application of IT technologies, are defined. Attention is drawn to the issue of collecting user experience data in applications that use a remote terminal connection using third-party software. Features of application of software interfaces of technologies which functionality can be used as a basis for method development are reviewed: technologies of containerization of the user environment of the operating system LXC and User Mode Linux, technology of packet interception based on the NetFilter network firewall and Open vSwitch virtual switch. Attention is also paid to isolating user processes and traffic from the host operating system environment, as well as the risks that may arise in the absence of measures and technologies of the sandbox software isolation. In the paper described the sequence of software implementation of the injective method, as well as the features of its use in the production environment. Attention is paid to logging changes to log files and real-time user activity logging. The features of the method are described in each of two variants of the basic containerization technology: LXC and User Mode Linux. The ways of increasing the security and reliability of the method itself when it is integrated with User Mode Linux virtualization technology are presented. Also ways of improving this approach by using additional Linux kernel modules are provided.

VME–based DAQ system for the Deuteron Spin Structure setup at the Nuclotron internal target station

The new powerful VME–based data acquisition (DAQ) system has been designed for the Deuteron Spin Structure setup [1] placed at the Nuclotron Internal Target Station [2]. The DAQ system is built using the netgraph–based data acquisition and processing frameworkngdp[3, 4]. The software dealing with VME hardware is a set ofnetgraphnodes in the form of the loadable kernel modules. The specific for current implementation nodes are described, while specific software utilities for the user context are the following. Theb2r(binary–to–ROOT) server converts raw data into per trigger and per accelerator spill representations, which are based on C++ classes derived from theROOTframework [5] ones. This approach allows us to generalize the code for histograms filling and polarization calculations. Theb2roptionally storesROOTevents asROOTTTree in file(s) on HDD, and supports the design of some express offine. ThehistGUIsoftware module provides an interactive online access for human operator to histograms filled by ther2h(ROOT–to–histograms) server, which obtains theROOTevent representations fromb2r. Ther2hsupports the calculation and histograming of runtime configurable variables as well as raw data variables, and optionally storesROOThistograms in file(s) on HDD. Since the spin studies at the Nuclotron require fast and precise determination of the deuteron and proton beam polarization, the polarization calculator software module is introduced. This calculator based on runtime configurabler2hcode allows us to compute polarization values online and integrate them into the Web–based scheme of representation and control of the polarimeters [6, 7].

Анализ корректности работы с памятью с использованием расширения теории символьных графов памяти предикатами над символьными значениями

Safety-critical systems require additional effort to comply with specifications. One of the required specification is correct memory usage. The article describes an efficient method for static verification against memory safety errors as a combination of Symbolic Memory Graphs and predicate abstraction on symbolic values used in graph. In this article, we introduce an extension of Symbolic Memory Graphs. In addition to symbolic values, the graph stores predicates over symbolic values, which allow to track the relationship between symbolic values in the graph. We also expand existing vertex types to support arbitrary abstract regions, which allow us to represent such dynamic data structures as lists and trees. One of the types of abstract regions is also the ODM region, which presents a special kind of on-demand memory that occurs when analyzing incomplete programs. For this memory, the size and structure of the contents are not known in advance, but it is believed that such memory can be operated safely. The method is implemented in CPAchecker tool. Practical usage is demonstrated on Linux kernel modules. The practical contribution of our work is to reduce false error messages by constructing more accurate abstractions using predicates over symbolic values.

The Design and Implementation of a Linux Kernel Module for File Descriptor Revocation

Privilege separation systems that are implemented in applications such as Chromium and OpenSSH Dae- mon(SSHD) are complex, cumbersome because they have to be built on top of traditional Access Control List(ACL) systems. Properties such as least privilege operations along with effective solutions to problems that plague ACL based implementations, such as the Confused Deputy problem makes Capabilities much more capable when compared with the current Mandatory Access Control (MAC)/ Discretionary Access Control(DAC) systems in use within the POSIX systems for implementing privilege separated applications. While some work has been done on integrating a capability system into Linux, the final implementation provided solution for a specific subset of problems that a typical Capability based systems addresses. We provide a kernel module that enhances the Linux File Descriptors (FD) with revocation property, that while providing as a starting point for future refinements and improvements for creating a Capability system, also provides sufficient advantages to existing work flows that involves privilege separation.