Self-healing mechanisms for kernel system compromises

Increasing demands for reliability and dependability clash with the reality of escalating security compromises and vulnerability discoveries. Improvements in attack methodologies such as polymorphic viruses, tampering of source code repositories, and automation of distributed strikes are no match for the untimely detection and manual recovery practices used today. We present a run-time method to automate recovery from kernel level system compromises. It is capable of returning modified system call table addresses back to their original values, terminating hidden processes, removing hidden files, and blocking attacker traffic to hidden connections. Self-healing mechanisms such as this can be employed to create more reliable intrusion tolerant operating systems and applications. A working prototype has been implemented as a loadable kernel module on Linux, and can be easily enhanced for other operating systems.