Kylin系统的内核级Rootkit防护

内核级rootkit是破坏内核完整性的最大威胁，它主要通过可加载模块方式和文件补丁方式破坏内核完整性。该文提出一种针对内核级rootkit威胁的防护模型，从一个可信根开始，开机引导验证完整性到系统运行时认证可加载模块，整个过程以信任链的形式传递，一级级度量，保证整个过程的可信赖性。讨论了该模型对系统性能的影响。

Kernel Level Rootkit Defense Under Kylin

Kernel level rootkit is the main threat that breaks kernel integrity,which breaks into kernel often through loading a loadable kernel module or patching files that will be loaded into kernel memory.Confronted of such a threat,this paper presents a defense model.From integrity validation in bootstrap to loadable kernel module verification when system is running,the whole process starts from a trusted root,transfers by a trust chain,and one stair attests next stair to guarantee the whole process trustful.The ...