This paper presents a new approach to dynamically monitoring operating system kernel integrity, based on a property called state-based control-flow integrity (SBCFI). Violations of SBCFI signal a persistent, unexpected modification of the kernel's control-flow graph. We performed a thorough analysis of 25 Linux rootkits and found that 24 (96%) employ persistent control-flow modifications; an informal study of Windows rootkits yielded similar results. We have implemented SBCFI enforcement as part of the Xen and VMware virtual machine monitors. Our implementation detected all the control-flow modifying rootkits we could install, while imposing unnoticeable overhead for both a typical web server workload and CPU-intensive workloads when operating at 10 second intervals.

Abstract In the past few years, wireless networks, specifically those based on the IEEE 802.11 standard, have experienced tremendous growth. However, numerous security problems have dampened this growth. The IEEE and vendors sensitive to these issues began a wholesale redesign of the security architecture, while simultaneously producing measures for mitigating existing problems. In this paper, we describe the past and future security architectures as well as the problems and concerns with both. Copyright © 2004 John Wiley & Sons, Ltd.