Numchecker: A System Approach for Kernel Rootkit Detection
summary
NumChecker is a VMM‑level system that detects control‑flow kernel rootkits by measuring low‑level events with Hardware Performance Counters and comparing syscall executions against offline reference traces. It runs on Linux KVM, records events like retired micro‑ops, retired instructions, near returns and branch stats, and flags deviations above a 5% deviation threshold (zero false positives in their tests). NumChecker adds a test‑program preamble, supports periodic sampling to distinguish similar kits, produces vector signatures for identification, and shows 1–4% runtime overhead in benchmarks.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:34Executive Summary
- 3:17Kernel Rootkit Behavior Classification
- 8:18Hardware Performance Counters (HPC)
- 12:24Two-Phase Detection and identification
- 14:31Syscall Measurement
- 16:59Kernel Preemption Handling
- 17:33Detection: Test Programs
- 18:43Detection: Choosing Proper Events
- 21:20Detection: Deviation Threshold
- 23:39Detection: Kernel Rootkits Detected
- 26:52Detection: Performance Evaluation
- 30:11Identification: Kernel Rootkits Identified
- 32:40Identification: Periodic Sampling
- 35:08Security Analysis
- 39:40Conclusion
related talks
31mBypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis
47mExposing Bootkits with BIOS Emulation
32mYou Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
31mDR. CHECKER: A Soundy Analysis for Linux Kernel Drivers
28mDigtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities
17mAll Bark and no Bite: vCPU Stall Detection for KVM Guests
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
49mBreaking Hardware-Enforced Security With Hypervisors