Detecting Kernel Rootkits in a Virtualized Infrastructure with Low-Level Architectural Features

Abstract

Security exploits and ensuant malware pose an increasing challenge to the cloud computing environments as the variety and complexity of malware continue to increase. Kernel rootkits are more formidable than other malware for their stealthiness and high privilege. A variety of software-based detection mechanisms have been explored to defeat kernel rootkits. However, existing methods suffer from their complexity. In this paper, we introduce HKRD, a system that utilizes low-level architectural features in the hypervisor to detect and identify malicious behaviors of kernel rootkits in a VM. By combining architectural features with machine learning on the Xen hypervisor, our implemented prototype shows its capacity to detect kernel rootkits with high accuracy and moderate performance cost.