ARM PMU 이벤트를 활용한 TrustZone 루트킷 탐지에 대한 연구
Detection of TrustZone Rootkits Using ARM PMU Events
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
모바일 장치에서 사용되는 ARM 프로세서는 하드웨어 기반의 격리 실행 환경인 TrustZone 개념을 도입하여 신뢰 실행 환경인 Secure World와 비신뢰 실행 환경인 Normal World를 구현하였다. 악성 소프트웨어의 종류 중 루트킷은 관리자 권한을 획득하고 자신의 존재를 숨기면서 백도어를 만든다. Secure World에서 동작하는 프로세스는 메모리 접근에 제한이 없고, 격리되어 있어 Secure World에서 루트킷이 실행되었을 때 탐지하기 어렵다. 본 논문에서는 하드웨어 기반의 성능 측정 모니터인 Performance Monitoring Unit을 활용하여 Secure World 루트킷의 이벤트를 측정하고 딥러닝 기반으로 루트킷을 탐지하는 기법을 제시한다.
Abstract
ARM processors, utilized in mobile devices, have integrated the hardware isolation framework, TrustZone technology, to implement two execution environments: the trusted domain “Secure World” and the untrusted domain “Normal World”. Rootkit is a type of malicious software that gains administrative access and hide its presence to create backdoors. Detecting the presence of a rootkit in a Secure World is difficult since processes running within the Secure World have no memory access restrictions and are isolated. This paper proposes a technique that leverages the hardware based PMU(Performance Monitoring Unit) to measure events of the Secure World rootkit and to detect the rootkit using deep learning.
참고문헌 (34)
- A. Khatoon, "Privacy concerns on android devices", 2017 IEEE International Conference on Consumer Electronics(ICCE), pp.149~152 (2017)
- P. Ketelaar, "The smartphone as your follower : the role of smartphone literacy in the relation between privacy concerns, attitude and behaviours towards phone-embedded tracking", Computers in Human Behavior, 78, pp.174~182 (2018)
- ARM, "ARM Cortext-A Series : Programmer’s Guide for ARMv8-A", ~ (2015)
- "GlobalPlatform Technology : TEE Protection Profile", Public release v1.3, ~ (2020)
- D. Cerdeira, "Sok : understanding the prevailing security vulnerabilities in trustzone-assisted tee systems", 2020 IEEE Symposium on Security and Privacy(SP), pp.1416~1432 (2020)
- F. Fleischer, "Memory corruption attacks within android tees : a case study based on op-tee", Proceedings of the 15th International Conference on Availability, Reliability and Security, pp.1~9 (2020)
- Marth, Daniel, "Abusing trust : mobile kernel subversion via trustzone rootkits", 2022 IEEE Security and Privacy Workshops(SPW), pp.26~276 (2022)
- Nadim, "Kernel-level rootkit detection, prevention and behavior profiling : a taxonomy and survey" (2023)
- Greg Hoglund, "Rootkit : Subverting the Windows Kernel", pp.199~242 (2005), Addison Wesley
- Wang, "A rule-based approach for rootkit detection", 2nd IEEE International Conference on Information Management and Engineering, pp.11~21 (2010), IEEE
- Song, Chengyu, "Enforcing kernel security invariants with data flow integrity" (2016), NDSS
- Joy, Jestin, "Rootkit detection mechanism : A survey", International Conference on Parallel Distributed Computing Technologies and Applications, pp.366~374 (2011), Springer Berlin Heidelberg
- Dong, Shangwu, "Kims : kernel integrity measuring system based on trustzone", 2020 6th International Conference on Big Data Computing and Communications (BIGCOM), pp.103~107 (2020), IEEE
- Ge, Xinyang, "Sprobes: Enforcing kernel code integrity on the trustzone architecture" (2014)
- Pappas, Vasilis, "Transparent {ROP} exploit mitigation using indirect branch tracing", 22nd USENIX Security Symposium(USENIX Security 13), pp.447~462 (2013)
- Kuruvila, Abraham Peedikayil, "Explainable machine learning for intrusion detection via hardware performance counters", IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 41(11), pp.4952~4964 (2022)
- Li, Congmiao, "Detecting spectre attacks using hardware performance counters", IEEE Transactions on Computers, 71(6), pp.1320~1331 (2022)
- Zhang, Yunjie, "Hardware-based detection of spectre attacks : a machine learning approach", 2020 Asian hardware oriented security and trust symposium(AsianHOST)IEEE, pp.1~6 (2020)
- Xia, Yubin, "CFIMon : Detecting violation of control flow integrity using performance counters", IEEE, 2012, 1~12[DOI]
- Shakevsky, Alon, "Trust Dies in Darkness : Shedding Light on Samsung's {TrustZone} Keymaster Design", 31st USENIX Security Symposium(USENIX Security 22), pp.251~268 (2022)
- Ryan, Keegan, "Hardware-backed heist : Extracting ECDSA keys from qualcomm's trustzone", Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp.181~194 (2019)
- "Open portable trusted execution environment op-tee" (2023)[URL]
- "OP-TEE documentation - optee_examples" (2023)[URL]
- "Mbed TLS" (2023)[URL]
- Chaganti, Rajasekhar, "Deep learning based cross architecture internet of things malware detection and classification", Computers & Security, 120 (2022)
- Li, Xinyao, "Cross-World Covert Channel on ARM Trustzone through PMU", Sensors, 22(19) (2022)
- Mushtaq, Maria, "Nights-watch : a cache-based side-channel intrusion detector using hardware performance counters", Proceedings of the 7th International Workshop on Hardware and Architectural Support for Security and Privacy, pp.1~8 (2018)
- "TensorFlow: Large-Scale Machine Learning on Heterogeneous Systems" (2023)[URL]
- Cook, Kees, "Kernel address space layout randomization", Linux Security Summit, May (2013)
- Jung, Benedikt, "Trusted monitor : Tee-based system monitoring", 2022 XII Brazilian Symposium on Computing Systems Engineering (SBESC), pp.1~8 (2022), IEEE
- Cerdeira, D, "{ReZone} : Disarming {TrustZone} with {TEE} Privilege Reduction", 31st USENIX Security Symposium(USENIX Security 22), pp.2261~2279 (2022)
- David, Robert, "Tensorflow lite micro : Embedded machine learning for tinyml systems", Proceedings of Machine Learning and Systems, 3, pp.800~811 (2021)
- Konaite, Matshehla, "Smart Hat for the blind with Real-Time Object Detection using Raspberry Pi and TensorFlow Lite", Proceedings of the International Conference on Artificial Intelligence and its Applications, pp.1~6 (2021)
- Idrissi, Idriss, "A lightweight optimized deep learning-based host-intrusion detection system deployed on the edge for IoT", International Journal of Computing and Digital System (2022)
