雲環境中基於虛擬機自我檢查偵測DKOM-Rootkit隱藏行為之研究

以作者查詢圖書館館藏

、以作者查詢臺灣博碩士

、以作者查詢全國書目

、勘誤回報

、線上人數：30

、訪客IP：3.144.4.135

姓名

謝明諺(Ming Yen Hsieh) 查詢紙本館藏

畢業系所

資訊工程學系

論文名稱

雲環境中基於虛擬機自我檢查偵測DKOM-Rootkit隱藏行為之研究
(Using Virtual Machine Introspection to Detect Hidden Behavior of DKOM-Rootkit in Cloud Environment)

相關論文

★ 無線行動隨意網路上穩定品質服務路由機制之研究	★ 應用多重移動式代理人之網路管理系統
★ 應用移動式代理人之網路協同防衛系統	★ 鏈路狀態資訊不確定下QoS路由之研究
★ 以訊務觀察法改善光突發交換技術之路徑建立效能	★ 感測網路與競局理論應用於舒適性空調之研究
★ 以搜尋樹為基礎之無線感測網路繞徑演算法	★ 基於無線感測網路之行動裝置輕型定位系統
★ 多媒體導覽玩具車	★ 以Smart Floor為基礎之導覽玩具車
★ 行動社群網路服務管理系統－應用於發展遲緩兒家庭	★ 具位置感知之穿戴式行動廣告系統
★ 調適性車載廣播	★ 車載網路上具預警能力之車輛碰撞避免機制
★ 應用於無線車載網路上之合作式交通資訊傳播機制以改善車輛擁塞	★ 智慧都市中應用車載網路以改善壅塞之調適性虛擬交通號誌

檔案

[Endnote RIS 格式]

[Bibtex 格式]

[相關文章]

[文章引用]

[完整記錄]

[館藏目錄]

至系統瀏覽論文 ( 永不開放)

摘要(中)

隨著網際網路的快速發展，各大企業早已將服務遷移至雲端之中。其中虛擬化技術（Virtualization）在此扮演整個雲端運算的重要角色，藉由在伺服器硬體層上加入一種特殊的虛擬機監視器（Hypervisor）軟體，將伺服器硬體資源抽象化，讓一台伺服器形成有多台虛擬機器（Virtual Machine, VM）同時運行的模樣，使得伺服器的使用效率大幅度的提升。另一方面，虛擬機器自我檢查技術（Virtual Machine Introspection, VMI）也被提出，VMI可透過Hypervisor取得VM之狀態，進一步對於VM狀態的特徵定義捕捉特定狀態之事件，當VM狀態為定義之事件時發出通知，並執行事件所定義處理方式。
本論文所提出的系統是針對DKOM-Rootkit（Direct Linux Kernel Object Manipulation Rootkit）以及其隱藏之物件的偵測以及移除機制，並提出基於隱藏行為的異常檢測機制(Hidden Behavior based Anomaly Detection, HBRAD)，透過VMI針對VM中每一條被執行的指令進行比對，來決定事件是否觸發，且觸發後將對於VM狀態進行分析並建構可信任視圖（Trusted View），同時也透過VMI向VM內部取得機制所需資訊並不可信任視圖（Untrusted View），進行比對找出隱藏的物件，並將其移除。

摘要(英)

With the rapid development of internet, the enterprises is migrating services to the Cloud. Among them, Virtualization technology is an important role in the Cloud. By adding a special software, Virtual Machine Monitor (Hypervisor), on the hardware layer, let the server hardware resources are abstracting, so that the server has the appearance of multiple Virtual Machines (VM) running at the same time, which greatly improves the efficiency of the server. As Virtualization technology becomes more mature, Virtual Machine Introspection (VMI) is proposed, VMI can get the status of VM by Hypervisor, and will further define the feature of the state of the VM to capture events in a specific state. When the VM state is a defined event, an alert is issued and the handling method defined by the event is executed.
The system proposed in this paper is aimed at the detection and removal mechanism of DKOM-Rootkit (Direct Linux Kernel Object Manipulation Rootkit) and its hidden objects, and proposes a Hidden Behavior based Anomaly Detection (HBRAD) mechanism, which comparing each executed instruction in the VM by VMI to determine whether the event is triggered, and after the alert, the VM state will be analyzed and further construct a trusted view. At the same time, the data required by the HBRAD mechanism will be obtained from the VM′s internal Untrusted View by VMI, and the untrusted view will be compared with trusted view to find out the hidden object and remove it.

關鍵字(中)

★ 雲端運算
★ 虛擬化技術
★ 虛擬機自我檢查技術
★ Linux Kernel
★ DKOM-Rootkit

關鍵字(英)

★ Cloud Computing
★ Virtualization
★ Virtual Machine Introspection
★ Linux Kernel
★ DKOM-Rootkit

論文目次

摘要 i
Abstract ii
誌謝 iii
目錄 iv
圖目錄 vii
表目錄 x
第一章緒論 1
1.1. 概要 1
1.2. 研究動機 1
1.3. 研究目的 3
1.4. 章節架構 3
第二章背景知識與相關研究 5
2.1. Cloud Computing 5
2.2. Virtualization 7
2.2.1. Open Source Hypervisor 8
2.2.2. Qemu 10
2.3. Virtual Machine Introspection 11
2.4. Linux Kernel 12
2.4.1. Calling Convention 13
2.4.2. Kernel Symbol Table 14
2.5. Rootkit 14
2.6. Intrusion Detection 15
2.6.1. Signature-based 15
2.6.2. Anomaly-based 15
2.7. 相關文獻之比較 16
第三章研究方法 19
3.1. 系統架構 19
3.1.1. Virtual Machine Introspector 20
3.1.2. vMemory Monitor Module 20
3.1.3. vCPU Monitor Module 22
3.1.4. Detection Module 23
3.1.5. Recovery Module 25
3.2. 系統運作 26
3.2.1. 資料符號表 26
3.2.2. HBRAD機制 28
3.2.3. 系統運作 30
3.3. 系統實作與假設 37
第四章實驗與討論 40
4.1. VMI的功能性驗證 42
4.1.1. 實驗一：針對Process的VMI Event之功能性驗證 42
4.1.2. 實驗二：針對Connection的VMI Event之功能性驗證 44
4.1.3. 實驗三：針對Module的VMI Event之功能性驗證 47
4.2. 偵測與移除DKOM-Rootkit與被隱藏之物件 49
4.2.1. 實驗四：針對Hidden Process的實作、偵測與移除 50
4.2.2. 實驗五：針對Backdoor的實作、偵測與移除 52
4.2.3. 實驗六：針對DKOM-Rootkit的實作、偵測與移除 56
4.3. HBRAD機制的效能分析 58
4.3.1. 實驗七：與其他機制進行比較 59
4.3.2. 實驗八：Linux Kernel版本通用性測試 61
4.3.3. 實驗九：Unix benchmark測試 62
第五章結論與未來研究方向 65
5.1. 結論 65
5.2. 研究限制 66
5.3. 未來研究方向 66
參考文獻 69

參考文獻

[1] Zhang, Shuai, et al. "Cloud computing research and development trend." 2010 Second international conference on future networks. IEEE, 2010.
[2] SOPHOS. “The Active Adversary Playbook 2021”, 2021 Accessed on: May 26, 2021. [Online]. https://news.sophos.com/en-us/2021/05/18/the-active-adversary-playbook-2021/
[3] BlackBerry, Inc., “Decade of the RATs Cross-Platform APT Espionage Attacks Targeting Linux, Windows and Android”, 2020. Accessed on: May 26, 2021. [Online]. Available: https://www.blackberry.com/us/en/events/security-summit/2020/pdfviewer?file=/content/dam/bbcomv4/blackberry-com/en/events/security-summit/assets/pdf/reConnection/reConnection-decade-of-the-rats.pdf
[4] QUICKSTART. “Why Linux Runs 90 percent of the Public Cloud Workload” Accessed on: May 26, 2021. [Online]. Available: https://www.quickstart.com/blog/why-linux-runs-90-percent-of-the-public-cloud-workload/
[5] M. Boelen. “rkhunter” Accessed on: May 26, 2021. [Online]. Available: http://rkhunter.sourceforge.net/
[6] Nelson Murilo. “chkrootkit” Accessed on: May 26, 2021. [Online]. Available: http://www.chkrootkit.org/
[7] Fargo, Farah, et al. "VM Introspection-based Allowlisting for IaaS." 2020 7th International Conference on Internet of Things: Systems, Management and Security (IOTSMS). IEEE, 2020.
[8] Hebbal, Yacine, Sylvie Laniepce, and Jean-Marc Menaud. "Hidden process detection using Linux Kernel Functions instrumentation." 2017 IEEE Conference on Dependable and Secure Computing. IEEE, 2017.
[9] Cui, Lei, et al. "XScope: Memory Introspection Based Malicious Application Detection." 2018 5th International Conference on Information Science and Control Engineering (ICISCE). IEEE, 2018.
[10] Qiang, Weizhong, et al. "CloudVMI: A cloud-oriented writable virtual machine introspection." IEEE Access 5 (2017): 21962-21976.
[11] Ye, Lin, et al. "Checking Function-Level Linux Kernel Control Flow Integrity for Cloud Computing." IEEE Access 6 (2018): 41856-41865.
[12] Hebbal, Yacine, Sylvie Laniepce, and Jean-Marc Menaud. "Virtual machine introspection: Techniques and applications." 2015 10th international conference on availability, reliability and security. IEEE, 2015.
[13] AX3. “GCP Professional Services Consultant in UK” Accessed on: May 26, 2021. [Online]. Available: https://ax3-systems.com/gcp-consulting-services-uk/
[14] RightScale. “2018 State of the Cloud ReConnection” Accessed on: May 26, 2021. [Online]. Available: https://news.lenovo.com/wp-content/uploads/2018/09/RightScale-2018-State-of-the-Cloud-ReConnection.pdf
[15] Rackspace Technology Blog. “Realising the Value of Cloud Computing with Linux” Accessed on: May 26, 2021. [Online]. Available: https://www.rackspace.com/en-gb/blog/realising-the-value-of-cloud-computing-with-linux
[16] Ret Had, Inc. “The state of Linux in the public cloud for enterprises” Accessed on: May 26, 2021. [Online]. Available: https://www.redhat.com/en/resources/state-of-linux-in-public-cloud-for-enterprises
[17] Kivity, Avi, et al. "kvm: the Linux virtual machine monitor." Proceedings of the Linux symposium. Vol. 1. No. 8. 2007.
[18] Barham, Paul, et al. "Xen and the art of virtualization." ACM SIGOPS operating systems review 37.5 (2003): 164-177.
[19] Xen Project. “Xen Project Software Overview” Accessed on: May 26, 2021. [Online]. Available: https://wiki.xenproject.org/wiki/Xen_Project_Software_Overview
[20] Suse. “Introduction to KVM Virtualization” Accessed on: May 26, 2021. [Online]. Available: https://documentation.suse.com/sles/15-SP2/html/SLES-all/cha-kvm-intro.html
[21] LibVMI Project. “LibVMI” Accessed on: May 26, 2021. [Online]. Available: https://libvmi.com/
[22] Fu, Yangchun, and Zhiqiang Lin. "Space traveling across vm: Automatically bridging the semantic gap in virtual machine introspection via online Linux Kernel data redirection." 2012 IEEE symposium on security and privacy. IEEE, 2012.
[23] Linux Kernel Organization, Inc. “The Linux Kernel Archives” Accessed on: May 26, 2021. [Online]. Available: https://www.Linux Kernel.org/
[24] It’s FOSS. “Linux Runs on All of the Top 500 Supercomputers, Again!” Accessed on: May 26, 2021. [Online]. Available: https://itsfoss.com/linux-runs-top-supercomputers/
[25] INTEZER. “2020 Set a Record for New Linux Malware Families” Accessed on: May 26, 2021. [Online]. Available: https://www.intezer.com/blog/cloud-security/2020-set-record-for-new-linux-malware-families/
[26] Michael Kerrisk. “ps(1) – Linux manual page” Accessed on: May 26, 2021. [Online]. Available: https://man7.org/linux/man-pages/man1/ps.1.html
[27] Michael Kerrisk. “lsmod(8) – Linux manual page” Accessed on: May 26, 2021. [Online]. Available: https://man7.org/linux/man-pages/man8/lsmod.8.html
[28] Fred Baumgarten. “netstat(8) – Linux manual page” Accessed on: May 26, 2021. [Online]. https://linux.die.net/man/8/netstat
[29] Michael Kerrisk. “Kill(1) – Linux manual page” Accessed on: May 26, 2021. [Online]. Available: https://man7.org/linux/man-pages/man1/Kill.1.html
[30] Fred Baumgarten. “rmmod(8) – Linux manual page” Accessed on: May 26, 2021. [Online]. https://linux.die.net/man/8/rmmod
[31] Ubuntu releases. “Ubuntu 20.04.2.0 LTS (Focal Fossa)” Accessed on: May 26, 2021. [Online]. https://releases.ubuntu.com/20.04/
[32] Perf Wiki. “perf: Linux profiling with performance counters” Accessed on: May 26, 2021. [Online]. https://perf.wiki.kernel.org/index.php/Main_Page
[33] Mortimer, Mathijs. "iperf3 documentation." (2018).
[34] OSTECHNIX. “UnixBench – A Benchmark Suite For Unix-like Systems” Accessed on: May 26, 2021. [Online]. https://ostechnix.com/unixbench-benchmark-suite-unix-like-systems/
[35] f0rb1dd3n. “Reptile” Accessed on: May 26, 2021. [Online]. https://github.com/f0rb1dd3n/Reptile
[36] m0nad. “Diamorphine” Accessed on: May 26, 2021. [Online]. https://github.com/m0nad/Diamorphine
[37] plusls. “rootkit” Accessed on: May 26, 2021. [Online]. https://github.com/plusls/rootkit
[38] xcellerator. “linux_kernel_hacking” Accessed on: May 26, 2021. [Online]. https://github.com/xcellerator/linux_kernel_hacking
[39] Giovanni Giacobbi. “The GNU Netcat project” Accessed on: May 26, 2021. [Online]. http://netcat.sourceforge.net/

指導教授

周立德(Li-Der Chou)

審核日期

2021-7-28

推文