Title

An Online Approach for Kernel-Level Keylogger Detection and Defense

DOI

10.6688/JISE.2017.33.2.10

Authors

田东海(DONGHAI TIAN);贾晓启(XIAOQI JIA);陈君华(JUNHUA CHEN);胡昌振(CHANGZHEN HU)

Key Words

keylogger detection ; virtualization ; OS kernel ; on-the-fly ; driver

PublicationName

Journal of Information Science and Engineering

Volume or Term/Year and Month of Publication

33卷2期(2017 / 03 / 01)

Page #

445 - 461

Content Language

英文

Chinese Abstract

Keyloggers have been studied for many years, but they still pose a severe threat to information security. Keyloggers can record highly sensitive information, and then transfer it to remote attackers. Previous solutions suffer from limitations in that: (1) Most methods focus on user-level keylogger detection; (2) Some methods need to modify OS kernels; (3) Most methods can be bypassed when the OS kernel is compromised. In this paper, we present LAKEED, an online defense against the kernel-level keylogger by utilizing the hardware assisted virtualization technology. Our system is compatible with the commodity operating system, and it can protect the running OS transparently. The basic idea of our approach is to isolate the target kernel extension that may contain the keylogger from keyboard drivers' execution environment and then monitor their potential interactions. By comparing the runtime information with the execution baseline that is obtained by the offline analysis, the keylogger can be identified. The evaluation shows that LAKEED can defeat kernel-level keyloggers effectively with low performance overhead.

Topic Category 基礎與應用科學 > 資訊科學