Covert remote syscall communication at kernel level: A SPOOKY backdoor

2015 ◽  
Author(s):  
Florian Kerber ◽  
Dominik Teubert ◽  
Ulrike Meyer
Keyword(s):  
Kernel Level

scholarly journals Kernel-level tracing for detecting stegomalware and covert channels in Linux environments

2021 ◽  
pp. 108010
Author(s):  
Luca Caviglione ◽  
Wojciech Mazurczyk ◽  
Matteo Repetto ◽  
Andreas Schaffhauser ◽  
Marco Zuppelli
Keyword(s):  
Covert Channels ◽  
Kernel Level

scholarly journals EZIOTracer

2021 ◽  
Vol 55 (1) ◽  
pp. 88-98
Author(s):  
Mohammed Islam Naas ◽  
François Trahay ◽  
Alexis Colin ◽  
Pierre Olivier ◽  
Stéphane Rubini ◽  
...  
Keyword(s):  
Analysis Framework ◽  
Comprehensive Understanding ◽  
Kernel Space ◽  
Data Intensive ◽  
Storage Performance ◽  
Performance Requirements ◽  
Memory Footprint ◽  
Extreme Performance ◽  
Data Intensive Applications ◽  
Kernel Level

Tracing is a popular method for evaluating, investigating, and modeling the performance of today's storage systems. Tracing has become crucial with the increase in complexity of modern storage applications/systems, that are manipulating an ever-increasing amount of data and are subject to extreme performance requirements. There exists many tracing tools focusing either on the user-level or the kernel-level, however we observe the lack of a unified tracer targeting both levels: this prevents a comprehensive understanding of modern applications' storage performance profiles. In this paper, we present EZIOTracer, a unified I/O tracer for both (Linux) kernel and user spaces, targeting data intensive applications. EZIOTracer is composed of a userland as well as a kernel space tracer, complemented with a trace analysis framework able to merge the output of the two tracers, and in particular to relate user-level events to kernel-level ones, and vice-versa. On the kernel side, EZIOTracer relies on eBPF to offer safe, low-overhead, low memory footprint, and flexible tracing capabilities. We demonstrate using FIO benchmark the ability of EZIOTracer to track down I/O performance issues by relating events recorded at both the kernel and user levels. We show that this can be achieved with a relatively low overhead that ranges from 2% to 26% depending on the I/O intensity.

A New Real-Time Process Monitor Method Based on MRC

2014 ◽  
Vol 971-973 ◽  
pp. 1481-1484
Author(s):  
Ke He Wu ◽  
Long Chen ◽  
Yi Li
Keyword(s):  
Information System ◽  
Real Time ◽  
Process Monitoring ◽  
Time Process ◽  
Monitoring Methods ◽  
Traditional Process ◽  
Kernel Level ◽  
Process Monitor

In order to ensure safe and stable running of applications, this paper analyses the limitation of traditional process-monitoring methods, and then designs a new real-time process monitor method based on Mandatory Running Control (MRC) technology. This method not only can monitor the processes, but also can control them from system kernel level to improve the reliability and safety of applications, so as to ensure the security and stability of information system.

scholarly journals CP-NAS: Child-Parent Neural Architecture Search for 1-bit CNNs

2020 ◽  
Author(s):  
Li'an Zhuo ◽  
Baochang Zhang ◽  
Hanlin Chen ◽  
Linlin Yang ◽  
Chen Chen ◽  
...  
Keyword(s):  
Computational Cost ◽  
Unified Framework ◽  
Embedded Devices ◽  
Natural Approach ◽  
Neural Architecture ◽  
Resource Limited ◽  
Training Stage ◽  
Comparable Accuracy ◽  
Kernel Level ◽  
High Computational Cost

Neural architecture search (NAS) proves to be among the best approaches for many tasks by generating an application-adaptive neural architectures, which are still challenged by high computational cost and memory consumption. At the same time, 1-bit convolutional neural networks (CNNs) with binarized weights and activations show their potential for resource-limited embedded devices. One natural approach is to use 1-bit CNNs to reduce the computation and memory cost of NAS by taking advantage of the strengths of each in a unified framework. To this end, a Child-Parent model is introduced to a differentiable NAS to search the binarized architecture(Child) under the supervision of a full-precision model (Parent). In the search stage, the Child-Parent model uses an indicator generated by the parent and child model accuracy to evaluate the performance and abandon operations with less potential. In the training stage, a kernel level CP loss is introduced to optimize the binarized network. Extensive experiments demonstrate that the proposed CP-NAS achieves a comparable accuracy with traditional NAS on both the CIFAR and ImageNet databases. It achieves an accuracy of 95.27% on CIFAR-10, 64.3% on ImageNet with binarized weights and activations, and a 30% faster search than prior arts.

A Review on Learning-based Detection Approaches of the Kernel-level Rootkit

2021 ◽  
Author(s):  
Mohammad Nadim ◽  
David Akopian ◽  
Wonjun Lee
Keyword(s):  
Kernel Level
Sign in / Sign up

Export Citation Format

Share Document