DMCA
SPECTRE: A Dependable Introspection Framework via System Management Mode
| Citations: | 6 - 4 self |
BibTeX
@MISC{Zhang_spectre:a,
author = {Fengwei Zhang and Kevin Leach and Kun Sun and Angelos Stavrou},
title = {SPECTRE: A Dependable Introspection Framework via System Management Mode},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract—Virtual Machine Introspection (VMI) systems have been widely adopted for malware detection and analysis. VMI systems use hypervisor technology for system introspection and to expose malicious activity. However, recent malware can detect the presence of virtualization or corrupt the hypervisor state thus avoiding detection. We introduce SPECTRE, a hardware-assisted dependability framework that leverages System Management Mode (SMM) to inspect the state of a system. Contrary to VMI, our trusted code base is limited to BIOS and the SMM implementations. SPECTRE is capable of transparently and quickly examining all layers of running system code including a hypervisor, the OS, and user level applications. We demonstrate several use cases of SPECTRE including heap spray, heap overflow, and rootkit detection using real-world attacks on Windows and Linux platforms. In our experiments, full inspection with SPECTRE is 100 times faster than similar VMI systems because there is no performance overhead due to virtualization. Keywords—SMM, introspection, memory attacks. I.
Keyphrases
system management mode dependable introspection framework system introspection hypervisor state memory attack several use case recent malware trusted code base hardware-assisted dependability framework vmi system malware detection performance overhead heap spray rootkit detection abstract virtual machine introspection smm implementation full inspection linux platform hypervisor technology keywords smm similar vmi system malicious activity user level application real-world attack system code
