Data-Centric OS Kernel Malware Characterization

Abstract—Traditional malware detection and analysis ap-proaches have been focusing on code-centric aspects of malicious programs such as detection of the injection of malicious code or matching malicious code sequences. However, modern mal-ware has been employing advanced strategies such as reusing legitimate code or obfuscating malware code to circumvent the detection. As a new perspective to complement code-centric approaches, we propose a data-centric OS kernel malware characterization architecture which detects and characterizes malware attacks based on the properties of data objects manipulated during the attacks. This framework consists of two system components with novel features. First, a runtime kernel object mapping system which has an un-tampered view of kernel data objects resistant to manipulation by malware. This view is effective at detecting a class of malware that hides dynamic data objects. Second, a new kernel malware detection approach that gener-ates malware signatures based on the data access patterns specific to malware attacks. This approach has an extended coverage that detects not only the malware with the signatures but also the malware variants which share the attack patterns by modeling the low level data access behaviors as signatures. Our experiments against a variety of real-world kernel rootkits demonstrate the effectiveness of data-centric malware signatures