- 期刊
- OpenAccess
An Online Approach for Kernel-Level Keylogger Detection and Defense
摘要
Keyloggers have been studied for many years, but they still pose a severe threat to information security. Keyloggers can record highly sensitive information, and then transfer it to remote attackers. Previous solutions suffer from limitations in that: (1) Most methods focus on user-level keylogger detection; (2) Some methods need to modify OS kernels; (3) Most methods can be bypassed when the OS kernel is compromised. In this paper, we present LAKEED, an online defense against the kernel-level keylogger by utilizing the hardware assisted virtualization technology. Our system is compatible with the commodity operating system, and it can protect the running OS transparently. The basic idea of our approach is to isolate the target kernel extension that may contain the keylogger from keyboard drivers' execution environment and then monitor their potential interactions. By comparing the runtime information with the execution baseline that is obtained by the offline analysis, the keylogger can be identified. The evaluation shows that LAKEED can defeat kernel-level keyloggers effectively with low performance overhead.
延伸閱讀
- Choi, J. (2007). Kernel Aware Module Verification for Robust Reconfigurable Operating System. Journal of Information Science and Engineering, 23(5), 1339-1347. https://doi.org/10.6688/JISE.2007.23.5.2
- 王茂吉（2003）。An Application-Based Intrusion Detection System for Web Server〔碩士論文，中原大學〕。華藝線上圖書館。https://doi.org/10.6840/cycu200300147
- Chieh, H. (2009). An Efficient Solution for Hook-Based Kernel Level Rootkits [master's thesis, National Tsing Hua University]. Airiti Library. https://www.airitilibrary.com/Article/Detail?DocID=U0016-1111200916112825
- Cheng, Y. J. (2014). A Storage-Layer Security Attack Damage Estimation Mechanism [master's thesis, National Chiao Tung University]. Airiti Library. https://doi.org/10.6842/NCTU.2014.00768
- TIAN, D., CHEN, J., HU, C., & XUE, J. (2016). A Secure and Efficient Kernel Log Transfer Mechanism for Virtualization Environments. Journal of Information Science and Engineering, 32(5), 1131-1143. https://www.airitilibrary.com/Article/Detail?DocID=10162364-201609-201703280016-201703280016-1131-1143