Kernel-level hidden rootkit detection based on eBPF

Abstract

With the rapid development of the Internet, entrusting data and services to cloud providers has become a prevailing trend among enterprises. However, this shift has also introduced new security threats, particularly the potential dangers posed by rootkits. Once these malicious software programs gain control of a system, they can conceal the activities of attackers. In particular, kernel-level rootkits are especially threatening and markedly difficult to detect. To counter kernel-level rootkit attacks, this study proposes a detection mechanism called the hidden kernel rootkit detector, specifically designed to detect hidden objects within Linux kernel-level rootkits. The mechanism utilizes the extended Berkeley Packet Filter technology and checks system calls during execution by comparing them with backed-up addresses to determine if they have been hijacked. If hijacking is detected, the system call is restored to its original address, and the attacker is removed from the system. Before a context switch occurs, the integrity of the process and module about to be executed is verified, and before a socket sends or receives messages, it is checked for existence within the system to defend against direct kernel object manipulation attacks. If system objects are found to have been tampered with, then they are restored to their original state, and the attacker is removed from the system.