@inproceedings{93c12d5c52044fb1b09e1709066444a0,
title = "NumChecker: Detecting kernel control-flow modifying rootkits by using hardware performance counters",
abstract = "This paper presents NumChecker, a new Virtual Machine Monitor (VMM) based framework to detect control-flow modifying kernel rootkits in a guest Virtual Machine (VM). NumChecker detects malicious modifications to a system call in the guest VM by checking the number of certain hardware events that occur during the system call's execution. To automatically count these events, NumChecker leverages the Hardware Performance Counters (HPCs), which exist in most modern processors. By using HPCs, the checking cost is significantly reduced and the tamper-resistance is enhanced. We implement a prototype of NumChecker on Linux with the Kernelbased Virtual Machine (KVM). Our evaluation demonstrates its practicality and effectiveness.",
keywords = "Hardware performance counters, Kernel rootkits, Virtualization",
author = "Xueyang Wang and Ramesh Karri",
year = "2013",
doi = "10.1145/2463209.2488831",
language = "English (US)",
isbn = "9781450320719",
series = "Proceedings - Design Automation Conference",
booktitle = "Proceedings of the 50th Annual Design Automation Conference, DAC 2013",
note = "50th Annual Design Automation Conference, DAC 2013 ; Conference date: 29-05-2013 Through 07-06-2013",
}