Hypervisor Scanning Kernel Data Structure Tampering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting and deterring attacks on the operating system kernel of a computer system is challenging due to their location in the kernel space, which is difficult for applications to detect or interrupt without affecting legitimate operations.
Innovation Solution
The method involves scanning memory pages for kernel data structure characteristics, taking snapshots, and comparing them with the kernel data structure stored in the kernel space to identify tampering, using a hypervisor to monitor memory regions and maintain a score for administrative actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If applications attempt to detect or interrupt kernel operations, then attack detection capability is improved, but system stability deteriorates due to disruption of legitimate operations
Solution Approach 1:
The patent introduces a hypervisor as an intermediary layer between applications and the kernel. The hypervisor monitors kernel data structure characteristics and detects tampering attempts without requiring applications to directly interact with kernel space. This mediator approach enables attack detection while preserving kernel operations and system stability, as the hypervisor can identify malicious modifications through characteristic analysis without interrupting legitimate kernel functionality.
2Measurement precision
If kernel data structure characteristics are scanned continuously, then tampering detection accuracy is improved, but system performance deteriorates due to increased processing overhead
Solution Approach 1:
The patent implements periodic scanning of kernel data structure characteristics rather than continuous monitoring. The hypervisor scans memory pages at intervals to detect changes in kernel data structure characteristics, maintaining detection accuracy while reducing processing overhead. This periodic approach balances security monitoring requirements with system performance considerations by limiting scan frequency to necessary intervals.
Solution Approach 2:
The patent establishes baseline characteristics of kernel data structures in advance before monitoring begins. By pre-defining what normal kernel data structure characteristics should look like, the system can quickly compare current states against these baselines during scanning, improving detection accuracy while minimizing processing time during actual monitoring operations.
3Measurement precision
If comprehensive kernel memory regions are monitored, then attack detection coverage is improved, but device complexity increases due to extended monitoring scope
Solution Approach 1:
The patent divides the kernel memory space into distinct segments or regions, each with specific characteristics that are monitored independently. Rather than monitoring all kernel memory uniformly, the hypervisor identifies and monitors specific memory pages containing kernel data structures based on their characteristics. This segmentation approach expands detection coverage to relevant areas while managing complexity by focusing monitoring efforts on specific segmented regions rather than the entire kernel space.
Data Source
AI summary
A method and apparatus for detecting kernel data structure tampering are disclosed. In the method and apparatus, a memory region of a computer system is scanned for one or more characteristics of a kernel data structure of an operating system kernel. It is then determined, based at least in part on identifying whether the one or more characteristics are found in the memory region, whether the kernel data structure is stored in the memory region of the computer system for tampering with the kernel data structure.