Recognize and Monitor Kernel Virtualization Using Memory Heat Map

Abstract

Increasingly cyber attacks target the inner rings of a computer system, and they have seriously undermined the integrity of the entire computer systems. We focus on the threat posed by smart phone root kits. Root kits are malware that stealthily modify operating system code and data to achieve malicious goals, and have long been a problem for desktops. We propose, in this paper, an autonomic architecture called SHARK. Secure Hardware support Against Root Kit by employing hardware support to provide system-level security without trusting the software stack, including the OS kernel. Smart phones expose several unique interfaces, such as voice, GPS and battery that root kits can exploit in novel ways. The emergence of hardware virtualization technology has led to the development of OS independent malware such as the Virtual Machine based rootkits (VMBRs). We draw attention to a different but related threat that exists on many commodity systems in operation today: The System Management Mode based root kit (SMBR). System Management Mode (SMM) is a relatively obscure mode on Intel processors used for low-level hardware control the predictable nature of real-time embedded applications. We introduce Memory Heat Map (MHM) to characterize the memory behavior of the operating system. Our machine learning algorithms automatically summarize the information contained in the MHMs and then detect deviations from the normal memory behavior patterns. Normally kernel can be protected by using three different strategies which includes monitoring the invoked process snooping the incoming packets at network level and establishing trust of a process by using TCB(Trusted computing Base updated by the admin) different methods in different layer for example In network layer by snooping incoming packets.