Abstract

In this paper, we present Vigilare system, a kernel integrity monitor that is architected to snoop the bus traffic of the host system from a separate independent hardware. This snoop-based monitoring enabled by the Vigilare system, over-comes the limitations of the snapshot-based monitoring em-ployed in previous kernel integrity monitoring solutions. Be-ing based on inspecting snapshots collected over a certain interval, the previous hardware-based monitoring solutions cannot detect transient attacks that can occur in between snapshots. We implemented a prototype of the Vigilare system on Gaisler’s grlib-based system-on-a-chip (SoC) by adding Snooper hardware connections module to the host system for bus snooping. To evaluate the benefit of snoop-based monitoring, we also implemented similar SoC with a snapshot-based monitor to be compared with. The Vigi-lare system detected all the transient attacks without perfor-mance degradation while the snapshot-based monitor could not detect all the attacks and induced considerable perfor-mance degradation as much as 10 % in our tuned STREAM benchmark test.