Identifying OS kernel objects for run-time security analysis

Amani S. Ibrahim; James Hamlyn-Harris; John Grundy; Mohamed Almorsy

doi:10.1007/978-3-642-34601-9_6

Identifying OS kernel objects for run-time security analysis

Amani S. Ibrahim, James Hamlyn-Harris, John Grundy, Mohamed Almorsy

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

Abstract

As dynamic kernel runtime objects are a significant source of security and reliability problems in Operating Systems (OSes), having a complete and accurate understanding of kernel dynamic data layout in memory becomes crucial. In this paper, we address the problem of systemically uncovering all OS dynamic kernel runtime objects, without any prior knowledge of the OS kernel data layout in memory. We present a new hybrid approach to uncover kernel runtime objects with nearly complete coverage, high accuracy and robust results against generic pointer exploits. We have implemented a prototype of our approach and conducted an evaluation of its efficiency and effectiveness. To demonstrate our approach's potential, we have also developed three different proof-of-concept OS security tools using it.

Original language	English
Title of host publication	Network and System Security - 6th International Conference, NSS 2012, Proceedings
Pages	72-85
Number of pages	14
Volume	7645 LNCS
DOIs	https://doi.org/10.1007/978-3-642-34601-9_6
Publication status	Published - 2012
Externally published	Yes
Event	International Conference on Network and System Security 2012 - Wuyishan, Fujian, China Duration: 21 Nov 2012 → 23 Nov 2012 Conference number: 6th

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	7645 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	International Conference on Network and System Security 2012
Abbreviated title	NSS 2012
Country/Territory	China
City	Wuyishan, Fujian
Period	21/11/12 → 23/11/12

Keywords

Kernel Data Structures
Operating Systems
Runtime Objects

Access to Document

10.1007/978-3-642-34601-9_6

Cite this

Ibrahim, A. S., Hamlyn-Harris, J., Grundy, J., & Almorsy, M. (2012). Identifying OS kernel objects for run-time security analysis. In Network and System Security - 6th International Conference, NSS 2012, Proceedings (Vol. 7645 LNCS, pp. 72-85). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7645 LNCS). https://doi.org/10.1007/978-3-642-34601-9_6

Ibrahim, Amani S. ; Hamlyn-Harris, James ; Grundy, John et al. / Identifying OS kernel objects for run-time security analysis. Network and System Security - 6th International Conference, NSS 2012, Proceedings. Vol. 7645 LNCS 2012. pp. 72-85 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{afd13e7c1f624f30ae8eff12e2316c89,

title = "Identifying OS kernel objects for run-time security analysis",

abstract = "As dynamic kernel runtime objects are a significant source of security and reliability problems in Operating Systems (OSes), having a complete and accurate understanding of kernel dynamic data layout in memory becomes crucial. In this paper, we address the problem of systemically uncovering all OS dynamic kernel runtime objects, without any prior knowledge of the OS kernel data layout in memory. We present a new hybrid approach to uncover kernel runtime objects with nearly complete coverage, high accuracy and robust results against generic pointer exploits. We have implemented a prototype of our approach and conducted an evaluation of its efficiency and effectiveness. To demonstrate our approach's potential, we have also developed three different proof-of-concept OS security tools using it.",

keywords = "Kernel Data Structures, Operating Systems, Runtime Objects",

author = "Ibrahim, {Amani S.} and James Hamlyn-Harris and John Grundy and Mohamed Almorsy",

year = "2012",

doi = "10.1007/978-3-642-34601-9_6",

language = "English",

isbn = "9783642346002",

volume = "7645 LNCS",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

pages = "72--85",

booktitle = "Network and System Security - 6th International Conference, NSS 2012, Proceedings",

note = "International Conference on Network and System Security 2012, NSS 2012 ; Conference date: 21-11-2012 Through 23-11-2012",

}

Ibrahim, AS, Hamlyn-Harris, J, Grundy, J & Almorsy, M 2012, Identifying OS kernel objects for run-time security analysis. in Network and System Security - 6th International Conference, NSS 2012, Proceedings. vol. 7645 LNCS, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 7645 LNCS, pp. 72-85, International Conference on Network and System Security 2012, Wuyishan, Fujian, China, 21/11/12. https://doi.org/10.1007/978-3-642-34601-9_6

Identifying OS kernel objects for run-time security analysis. / Ibrahim, Amani S.; Hamlyn-Harris, James; Grundy, John et al.
Network and System Security - 6th International Conference, NSS 2012, Proceedings. Vol. 7645 LNCS 2012. p. 72-85 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7645 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

TY - GEN

T1 - Identifying OS kernel objects for run-time security analysis

AU - Ibrahim, Amani S.

AU - Hamlyn-Harris, James

AU - Grundy, John

AU - Almorsy, Mohamed

N1 - Conference code: 6th

PY - 2012

Y1 - 2012

N2 - As dynamic kernel runtime objects are a significant source of security and reliability problems in Operating Systems (OSes), having a complete and accurate understanding of kernel dynamic data layout in memory becomes crucial. In this paper, we address the problem of systemically uncovering all OS dynamic kernel runtime objects, without any prior knowledge of the OS kernel data layout in memory. We present a new hybrid approach to uncover kernel runtime objects with nearly complete coverage, high accuracy and robust results against generic pointer exploits. We have implemented a prototype of our approach and conducted an evaluation of its efficiency and effectiveness. To demonstrate our approach's potential, we have also developed three different proof-of-concept OS security tools using it.

AB - As dynamic kernel runtime objects are a significant source of security and reliability problems in Operating Systems (OSes), having a complete and accurate understanding of kernel dynamic data layout in memory becomes crucial. In this paper, we address the problem of systemically uncovering all OS dynamic kernel runtime objects, without any prior knowledge of the OS kernel data layout in memory. We present a new hybrid approach to uncover kernel runtime objects with nearly complete coverage, high accuracy and robust results against generic pointer exploits. We have implemented a prototype of our approach and conducted an evaluation of its efficiency and effectiveness. To demonstrate our approach's potential, we have also developed three different proof-of-concept OS security tools using it.

KW - Kernel Data Structures

KW - Operating Systems

KW - Runtime Objects

UR - http://www.scopus.com/inward/record.url?scp=84871536895&partnerID=8YFLogxK

U2 - 10.1007/978-3-642-34601-9_6

DO - 10.1007/978-3-642-34601-9_6

M3 - Conference Paper

AN - SCOPUS:84871536895

SN - 9783642346002

VL - 7645 LNCS

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 72

EP - 85

BT - Network and System Security - 6th International Conference, NSS 2012, Proceedings

T2 - International Conference on Network and System Security 2012

Y2 - 21 November 2012 through 23 November 2012

ER -

Ibrahim AS, Hamlyn-Harris J, Grundy J, Almorsy M. Identifying OS kernel objects for run-time security analysis. In Network and System Security - 6th International Conference, NSS 2012, Proceedings. Vol. 7645 LNCS. 2012. p. 72-85. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-642-34601-9_6

Identifying OS kernel objects for run-time security analysis

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Cite this