Kernel Memory Polling for Non-Intrusive System Call Tracing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing system call tracing methods, particularly in virtual machines, are intrusive and cause performance degradation, and sophisticated malware can evade detection by disabling tracing tools, making it difficult to implement non-intrusive, real-time monitoring.
Innovation Solution
A non-intrusive system call tracing method that uses a polling thread to monitor kernel memory structures, specifically the Linux x86_64 OS, to recover register data and construct system call traces without pausing the virtual machine, leveraging virtual-to-physical translation for faster detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If intrusive system call tracing methods are used, then system call traces can be obtained, but performance degradation occurs
Solution Approach 1:
The patent introduces a polling thread as an intermediary component that monitors kernel memory structures without directly interfering with system call execution. This mediator approach allows trace data collection while maintaining normal system operation, resolving the contradiction between trace accuracy and system performance.
Solution Approach 2:
The patent replaces traditional intrusive mechanical tracing methods with a memory-based polling mechanism. Instead of hooking into system call execution paths, the system polls kernel memory structures to detect system call events, reducing performance impact while maintaining trace capability.
2Measurement precision
If traditional tracing tools are used, then system call activity can be monitored, but sophisticated malware can detect and disable them
Solution Approach 1:
The polling thread acts as a hidden intermediary that monitors system calls through memory polling rather than through visible tracing interfaces. Malware cannot easily detect or disable this indirect monitoring mechanism, as it does not present the same detection surfaces as traditional tracing tools.
Solution Approach 2:
The system creates a copy of the tracing functionality through the polling thread that operates independently from traditional tracing tools. This parallel copying of trace capabilities allows detection without exposing the same vulnerability points that malware targets in conventional tools.
3Loss of time
If real-time tracing is implemented, then live system call monitoring is achieved, but latency increases
Solution Approach 1:
The patent implements periodic polling of kernel memory structures at optimized intervals. This periodic action allows the system to detect system calls in real-time while controlling the frequency of memory access to minimize latency impact on system performance.
Solution Approach 2:
The system dynamically adjusts polling parameters such as interval timing and memory access patterns to optimize between detection speed and latency. By changing these parameters based on system state, the patent achieves real-time tracing capability while minimizing performance degradation.
Data Source
AI summary
Technologies for system call trace reconstruction are described. A method includes determining, by one or more processors, a set of memory locations of a kernel memory structure. The set of memory locations stores data indicating one or more parameters of a user-associated process. The method further includes determining that a first value of a first of the set of memory location has changed. The method further includes determining an execution of a first system call associated with the user-associated process and the kernel memory structure. The method further includes retrieving one or more values corresponding to individual memory location of the set of memory location associated with the first system call. The method further includes providing an output identifying the first system call based on the one or more values corresponding to the individual memory locations.