Kernel Code Research Articles

NPTS-PK: A new point kernel code for fast calculation of 3D gamma radiation field

The point kernel integration method is commonly utilized for the analytical calculation of gamma radiation fields in the field of radiation protection and shielding design. This study introduces NPTS-PK, a program developed for rapid calculation of 3D gamma radiation fields based on the NPTS program and the point kernel integration method. Based on the geometric construction and input method of the NPTS program, NPTS-PK supports point kernel calculations for radiation sources and shielding structures of various complex shapes and materials. By calculating material attenuation coefficients using continuous energy cross-section parameters, combined with a more precise buildup factor calculation method, the accuracy of calculation results has been enhanced. Improvements in ray tracing processes and the implementation of the probability neighbor list method have accelerated geometric processing. To address the challenge of excessive computation time associated with large-scale grid counting in point kernel programs, NPTS-PK integrates several efficient acceleration techniques, elevating the speed of radiation field calculation by an order of magnitude. Tests on typical model and engineering scenario demonstrate that the deviation between NPTS-PK results and the reference values is within a few tens of percent, and the computational efficiency and accuracy are improved compared to the standard point kernel programs.

Mitigation of privilege escalation attack using kernel data relocation mechanism

Kernel memory corruption, which leads to a privilege escalation attack, has been reported as a security threat to operating systems. To mitigate privilege escalation attacks, several security mechanisms are proposed. Kernel address space layout randomization randomizes kernel code and data virtual address layout on the kernel memory. Privileged information protection methods monitor and restore illegal privilege modifications. Therefore, if an adversary identifies the kernel data containing privileged information, an adversary can achieve the privilege escalation in a running kernel. This paper proposes a kernel data relocation mechanism (KDRM) that dynamically relocates privileged information in the running kernel to mitigate privilege escalation attacks. The KDRM introduces the relocation-only page into the kernel. The relocation-only page allows the virtual address of the privileged information to change by dynamically relocating for the user process. One of the relocation-only pages is randomly selected to store the privileged information at the system call invocations. The evaluation results indicate the possibility of mitigating privilege escalation attacks through direct memory overwriting by user processes on Linux with KDRM. The KDRM showed an acceptable performance cost. The overhead of a system call was up to 11.52%, and the kernel performance score was 0.11%.

Unishyper: A Rust-based unikernel enhancing reliability and efficiency of embedded systems

Unikernels are simple, customizable, efficient, and small in code size, which makes them highly applicable to embedded scenarios. However, most existing unikernels are developed and optimized for cloud computing, and they do not fully meet the requirements of high reliability and platform customization in embedded environments. We propose Unishyper, a reliable and high-performance embedded unikernel in Rust. To support memory isolation between user applications, user code, and kernel code, Unishyper designs the Zone mechanism on top of Intel MPK. Unishyper further proposes a thread-level unwind strategy for safe fault handling while avoiding memory leakage. Finally, Unishyper supports fine-grained customization, seamlessly integrates with the Rust ecosystem, and uses Unilib for function offloading to further reduce image size. Our evaluation results show that Unishyper achieves better performance than peer unikernels on major micro-benchmarks, can effectively stop illegal memory accesses across application boundaries, and has a minimal memory footprint of less than 100 KB.

PDATC-NCPMKL: Predicting drug's Anatomical Therapeutic Chemical (ATC) codes based on network consistency projection and multiple kernel learning

The development and discovery of new drugs is time-consuming and needs lots of human and material resources. Therefore, discovery of novel effects of existing drugs is an important alternative way, which can accelerate the process of designing “new” drugs. The anatomical Therapeutic Chemical (ATC) classification system recommended by World Health Organization (WHO) is a basic research area in this regard. A novel ATC code of an existing drug suggests its novel effects. Some computational models have been proposed, which can predict the drug-ATC code associations. However, their performance is not very high. There still exist spaces for improvement. In this study, a new recommendation system (named PDATC-NCPMKL), which incorporated network consistency projection and multi-kernel learning, was designed to identify drug-ATC code associations. For drugs or ATC codes, several kernels were constructed, which were fused by a multiple kernel learning method and an additional kernel integration scheme. To enhance the performance, the drug-ATC code association adjacency matrix was reformulated by a variant of weighted K nearest known neighbors (WKNKN). The reformulated adjacency matrix, drug and ATC code kernels were fed into network consistency projection to generate the association score matrix. The proposed recommendation system was tested on the ATC codes at the second, third and fourth levels in drug ATC classification system using ten-fold cross-validation. The results indicated that all AUROC and AUPR values were close to or exceeded 0.96. Such performance was higher than some existing computational models. Some additional tests were conducted to prove the utility of adjacency matrix reformulation and to analyze the importance of drug and ATC code kernels.

Drootkit: Kernel-Level Rootkit Detection and Recovery Based on eBPF

The concealment of rootkits makes them a significant security threat. Kernel-level rootkits can be extremely dangerous as they have high system privileges. A typical type of kernel-level rootkits is to hook system calls which are essential for overall system functionality. This paper presents drootkit, a tool to detect kernel-level rootkits that hook system calls. Additionally, drootkit can recover damaged systems. This tool utilizes eBPF technology, ensuring both flexibility and security. When installing new kernel modules, the virtual address range of the initial kernel code will not be affected. In light of this, drootkit conducts bounds checking on all system calls within the system. In the case of system calls being hooked, drootkit can detect and recover them while issuing warning messages. For testing purposes, this paper also implements a malicious kernel module that can hook system calls and run on the arm64 platform. We have conducted an experiment that confirms drootkit’s capability to detect rootkits while also effectively restoring the system. Moreover, drootkit has very low system overhead and does not significantly affect system performance, making it a reliable choice for a backend program that can run for an extended period of time.

The Opportunities and Limitations of Extended Page Table Switching for Fine-Grained Isolation

Extended Page Table switching with VMFUNC is a hardware isolation mechanism available in Intel CPUs. VMFUNC is attractive for low overhead and the possibility to isolate privileged kernel code. However, many careful design decisions are needed to ensure the security of the isolation boundary.

User-driven Online Kernel Fusion for SYCL

Heterogeneous programming models are becoming increasingly popular to support the ever-evolving hardware architectures, especially for new and emerging specialized accelerators optimizing specific tasks. While such programs provide performance portability of the existing applications across various heterogeneous architectures to some extent, short-running device kernels can affect an application performance due to overheads of data transfer, synchronization, and kernel launch. While in applications with one or two short-running kernels the overhead can be negligible, it can be noticeable when these short-running kernels dominate the overall number of kernels in an application, as it is the case in graph-based neural network models, where there are several small memory-bound nodes alongside few large compute-bound nodes. To reduce the overhead, combining several kernels into a single, more optimized kernel is an active area of research. However, this task can be time-consuming and error-prone given the huge set of potential combinations. This can push programmers to seek a tradeoff between (a) task-specific kernels with low overhead but hard to maintain and (b) smaller modular kernels with higher overhead but easier to maintain. While there are DSL-based approaches, such as those provided for machine learning frameworks, which offer the possibility of such a fusion, they are limited to a particular domain and exploit specific knowledge of that domain and, as a consequence, are hard to port elsewhere. This study explores the feasibility of a user-driven kernel fusion through an extension to the SYCL API to address the automation of kernel fusion. The proposed solution requires programmers to define the subgraph regions that are potentially suitable for fusion without any modification to the kernel code or the function signature. We evaluate the performance benefit of our approach on common neural networks and study the performance improvement in detail.

Kernel Code Integrity Protection at the Physical Address Level on RISC-V

An operating system kernel has the highest privilege in most computer systems, making its code integrity critical to the entire system’s security. Failure to protect the kernel code integrity allows an attacker to modify the kernel code pages directly or trick the kernel into executing instructions stored outside the kernel code pages. Existing prevention mechanisms rely on the memory management unit in which certain memory pages are marked as not-executable in supervisor mode to prevent such attacks. However, an attacker can bypass these existing mechanisms by directly manipulating the page table contents to mark the memory pages with malicious code as supervisor-executable. This paper shows that a small architectural extension enables a physical address-level mechanism to stop this threat without relying on page table integrity. PrivLock lets, at boot time, the kernel specifies the physical address ranges containing its code. At run time, PrivLock ensures that the content within the range is not manipulated and that only the instructions from those pages are executed while the processor runs in supervisor mode. Despite this protection, the kernel can still create new code pages ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">e.g</i> ., for loadable kernel modules) and make them executable with the help of PrivLock’s secure loader. The experimental results show that PrivLock incurs low performance (<0.5%), area (0.14–0.3%), and energy/power (0.053–2%) overhead.

An LED-Based structured illumination microscope using a digital micromirror device and GPU accelerated image reconstruction.

When combined with computational approaches, fluorescence imaging becomes one of the most powerful tools in biomedical research. It is possible to achieve resolution figures beyond the diffraction limit, and improve the performance and flexibility of high-resolution imaging systems with techniques such as structured illumination microscopy (SIM) reconstruction. In this study, the hardware and software implementation of an LED-based super-resolution imaging system using SIM employing GPU accelerated parallel image reconstruction is presented. The sample is illuminated with two-dimensional sinusoidal patterns with various orientations and lateral phase shifts generated using a digital micromirror device (DMD). SIM reconstruction is carried out in frequency space using parallel CUDA kernel functions. Furthermore, a general purpose toolbox for the parallel image reconstruction algorithm and an infrastructure that allows all users to perform parallel operations on images without developing any CUDA kernel code is presented. The developed image reconstruction algorithm was run separately on a CPU and a GPU. Two different SIM reconstruction algorithms have been developed for the CPU as mono-thread CPU algorithm and multi-thread OpenMP CPU algorithm. SIM reconstruction of 1024 × 1024 px images was achieved in 1.49 s using GPU computation, indicating an enhancement by ∼28 and ∼20 in computation time when compared with mono-thread CPU computation and multi-thread OpenMP CPU computation, respectively.

Analysis of Digital Transformation of Enterprise Accounting Talents from the Perspective of Blockchain

In order to improve the digital transformation effect of enterprise accounting talents, this paper combines intelligent methods to carry out the digital transformation of enterprise accounting talents from the perspective of blockchain. Moreover, this paper studies the sliding window CS-SCHT algorithm in depth. Based on the theoretical derivation of the sliding window CS-SCHT based on the gray code kernel, the algorithm is implemented on the computer platform, and the test experiment of the operation time is carried out. In addition, this paper explores the application of the sliding window CS-SCHT algorithm in adaptive filtering. The experimental results show that the adaptive filter based on the CS-SCHT algorithm can obtain a higher signal-to-noise ratio than the sliding window DFT algorithm. Finally, this paper constructs an intelligent accounting digital information processing system. The research shows that the system proposed in this paper can play an important role in the digital transformation of enterprise accounting talents from the perspective of blockchain.

Application of Internet of Things in Online Teaching of Adult Education Based on Android Voice Assistant

Adult education is an important part of lifelong learning; with the rapid development of economy in recent years, the society has put forward many new requirements for lifelong education; and many new problems have emerged in adult higher education. Online education is the medium of distance learning. Due to the continuous development of Internet+ and the continuous growth and rapid development of online education, it provides unprecedented opportunities for the development and utilization of high-quality education resources. Based on the research on the recommendation method of online courses in adult higher education, this paper designs and develops an online education platform for Adult Higher Education. The intelligence of mobile devices has made mobile phones an indispensable device in people’s lives, excellent human-computer interaction design, and open-source kernel code that make Android the best choice for developing mobile applications. Therefore, in this paper, we will build an adult online education framework based on Android voice for Internet of things technology, design a monitoring node for Internet of things, design and implement an online education monitoring system for adult NB people, and research, collect, and send the learning status information of Internet of things technology. The results show that the function of the system can be effectively realized, the operation efficiency is high, and the personalized course design can be provided.

Point Kernel Modification Including Support Vector Regression Neutron Buildup Factor Models

This work presents the results of radiation shielding calculations using modified point kernel code QAD-CGGP. The modification includes a new approach to neutron buildup factor estimations based on machine learning technique called Support vector regression (SVR). SVR neutron buildup factor models for common shielding materials are developed and built into the QAD-CGGP. The development of the models consisted of acquiring the data to be used for learning the model, optimizing the SVR parameters, and application of active learning methods for improving the learning process. The modified code is tested, and the results are compared with the MCNP6 results.

Dose Calculation for Emergency Control Room HVAC Filter

NPP Krsko is introducing Emergency Control Room (ECR) as part of safety upgrades. According to 10CFR50 Appendix A, GDC 19, both main control room and emergency control room should have adequate radiation protection to permit operators to shutdown the plant and keep it in safe shutdown conditions without receiving more than 50 mSv effective whole body dose, within 30 days from accident initiation. One of the important prerequisites to achieve that is proper operation of control room HVAC. In this work we are focused to calculation of gamma doses from radioactive materials accumulated in HEPA and charcoal filters during 30 days of HVAC operation. The dose at selected points around the filter was calculated using Microshield 10.0 point kernel code. The radioactive gamma source is calculated using RADTRAD 3.03 for plant's severe accident SGTR sequence calculated with MAAP 4.0.7 code. Calculated dose rates at peak filter activity are compared against results obtained with SCALE 6.2 MAVRIC shielding sequence (Monaco Monte Carlo functional module and CADIS methodology). The reasonable agreement between point kernel and hybrid Monte Carlo results was obtained.

FSbrain: An intelligent I/O performance tuning system

To bridge the performance gap between network and storage, performance tuning of file systems according to different workloads has become an important work on the Internet of Things (IoT). However, existing methods on file system tuning mainly focused on tailoring the file system kernel codes, or cannot scope to high dimensional parameters and dynamically changing workloads. In this paper, we propose an automatic I/O performance tuning system FSbrain that recommends reasonable and performance-efficient configurations for file systems by using machine learning. It makes the configuration recommendations based on current workloads within an acceptable time, however, without any manual interventions or kernel code modifications. In specific, FSbrain mainly consists of two phases which are model training and configuration tuning. Since tuning attempts will cause frequent remounting on target file systems, we deploy FSbrain and conduct the tuning sessions on an experimental node called “shadow server”. We evaluate FSbrain on three representative file systems (namely, Ext4, F2FS, and PMFS). The experimental results show that the configuration recommended by FSbrain can improve the I/O performance by up to 1.28× averagely than the default configuration. Besides, FSbrain reduces the overall tuning time by 90% compared to manual tuning.

H-KPP: Hypervisor-Assisted Kernel Patch Protection

We present H-KPP, hypervisor-based protection for kernel code and data structures. H-KPP prevents the execution of unauthorized code in kernel mode. In addition, H-KPP protects certain object fields from malicious modifications. H-KPP can protect modern kernels equipped with BPF facilities and loadable kernel modules. H-KPP does not require modifying or recompiling the kernel. Unlike many other systems, H-KPP is based on a thin hypervisor and includes a novel SLAT switching mechanism, which allows H-KPP to achieve very low (≈6%) performance overhead compared to baseline Linux.

Set the configuration for the heart of the OS

This paper presents a study on the practicality of operating system (OS) kernel debloating, that is, reducing kernel code that is not needed by the target applications. Despite their significant benefits regarding security (attack surface reduction) and performance (fast boot time and reduced memory footprints), the state-of-the-art OS kernel debloating techniques are not widely adopted in practice, especially in production environments. We identify the limitations of existing kernel debloating techniques that hinder their practical adoption, such as both accidental and essential ones. To understand these limitations, we build an advanced debloating framework named Cozart that enables us to conduct a number of experiments on different types of OS kernels (such as Linux and the L4 microkernel) with a wide variety of applications (such as HTTPD, Memcached, MySQL, NGINX, PHP, and Redis). Our experimental results reveal the challenges and opportunities in making OS kernel debloating practical. We share these insights and our experience to shed light on addressing the limitations of kernel debloating techniques in future research and development efforts.

An efficient implementation of one-dimensional discrete wavelet transform algorithms for GPU architectures

In this paper, the authors present several self-developed implementation variants of the Discrete Wavelet Transform (DWT) computation algorithms and compare their execution times against the commonly approved ones for representative modern Graphics Processing Units (GPUs) architectures. The proposed solutions avoid the time-consuming modulo divisions and conditional instructions used for DWT filters wrapping by proper expansion of the DWTs input data vectors. The main goal of the research is to improve the computation times for popular DWT algorithms for representative modern GPU architectures while retaining the code’s clarity and simplicity. The relations between algorithms execution time improvements for GPUs are also compared with their counterparts for traditional sequential processors. The experimental study shows that the proposed implementations, in the case of parallel realization on GPUs, are characterized by very simple kernel code and high execution time performance.

Refcount Field Identification for Linux Kernel Based on Deep Learning

Reference counting (refcount) is a common memory management technique in modern software. Refcount errors can often lead to severe memory errors such as memory leak and use-after-free. Many efforts to harden refcount security rely on known refcount fields as their input. However, due to the complexity of software code, identifying refcount fields in source code is very challenging. Traditional methods of identifying refcount fields are mainly based on code pattern matching and have great limitations such as requiring expert experience to summarize code patterns, which is a laborious job. Besides, the manually summarized patterns do not cover all cases, resulting in low recall rate. To address these problems, this paper proposes to characterize a field based on the field name and the code behavior associated with the field and designs a multimodal deep learning based approach. The paper implements a prototype of the new approach for Linux kernel code. In the evaluation, the precision and recall rate achieved by the prototype system are 96.98% and 93.54%, respectively. In contrast, the traditional identification method based on code pattern matching did not report any refcount fields on the testing set. In addition, we identify 61 refcount fields which are implemented with insecure data types in the latest Linux kernel. Until now, we have reported 21 of them to the Linux community, of which six have been confirmed.

Safer Linux Kernel Modules Using the D Programming Language

Since its creation, the Linux kernel has gained international recognition and has been employed on a large range of devices: servers, supercomputers, smart devices and embedded systems. Given its popularity, the security of the kernel has become a critical research topic. As a consequence, a wide range of third party tools were created to detect bugs in its implementation. However, new vulnerabilities are discovered and exploited every year. The explanation for this phenomenon lies in the fact that the programming language that is used for the kernel implementation, C, is designed to allow unsafe memory operations. In this paper, we show that it is possible to incrementally transition the kernel code from C to a memory safe programming language, D, by porting and integrating a device driver. In addition, we propose a series of code transformations that allow the D compiler to reason about the safety of certain memory operations. Our implementation increases the security guarantees of the kernel without incurring any performance penalties.

A Hardware Platform for Ensuring OS Kernel Integrity on RISC-V

The OS kernel is typically preassumed as a trusted computing base in most computing systems. However, it also implies that once an attacker takes control of the OS kernel, the attacker can seize the entire system. Because of such security importance of the OS kernel, many works have proposed security solutions for the OS kernel using an external hardware module located outside the processor. By doing this, these works can realize the physical isolation of security solutions from the OS kernel running in the processor, but they cannot access the inner state of the processor, which attackers can manipulate. Thus, they elaborated several methods to overcome such limited capability of external hardware. However, those methods usually come with several side effects, such as high-performance overhead, kernel code modifications, and/or excessively complicated hardware designs. In this paper, we introduce RiskiM, a new hardware-based monitoring platform to ensure kernel integrity from outside the host system. To deliver the inner state of the host to RiskiM, we have devised a hardware interface architecture, called PEMI. Through PEMI, RiskiM is supplied with all internal states of the host system essential for fulfilling its monitoring task to protect the kernel. To empirically validate our monitoring platform’s security strength and performance, we have fully implemented PEMI and RiskiM on a RISC-V based processor and FPGA, respectively. Our experiments show that RiskiM succeeds in the host kernel protection by detecting even the advanced attacks which could circumvent previous solutions, yet suffering from virtually no aforementioned side effects.