In the past decade, commodity software applications have been deployed more than ever in almost every domain. Having the ability to differentiate the original trusted application at run‐time from its compromised, mimic or trojanised versions would mitigate a broad range of intrusion threats to these applications. This has been addressed by application‐level intrusion detection systems, however, such schemes mostly depend on the system software for either monitoring or modelling the application. This is while system software can itself get compromised by kernel‐level rootkit attacks. In this study, the authors have proposed a new hardware‐based app‐IDS, which works independent of the system software of the target system. The proposed method, referred to as HPCgnature , includes a new abstraction corresponding to the repetitious functionalities of programs. Such functionalities generate a distinguishing sequence of periods, referred to in this study as the Operational Periodicity . The method uses monitoring scheme based on external access to the hardware performance counters of CPUs. Implementing a prototype, they have shown how HPCgnature can detect intrusions in 12 complex interactive desktop applications. Evaluation results indicate this model could differentiate applications with 98% accuracy, and can detect even small run‐time code injection attacks by an accuracy of >75%

To address the vast variety of computing requirements in recent ubiquitous computing ecosystem, there is a constant need for more complex computing systems that consist of integrated hardware (HW) and software (SW) systems. Providing an architectural insight into such systems helps in achieving a more efficient usage of system resources, verifying the characteristics of a platform and provisioning of its security and trust. Architecture reconstruction (AR) has been used in software engineering to gain a deeper insight into specific software. Neither software AR nor hardware reverse engineering techniques are sufficient to extract the architecture of a system that incorporates both HW/SW, since they are unable to recover the relationships between the HW and SW components. Inspired by the Symphony software AR framework, we propose a method to reconstruct the architecture of a computing platform as a whole. In order to cover the wide variety of existing HW/SW technologies, our method uses an ontology-based approach. Due to the lack of a comprehensive ontology in literature, we developed PLATOnt, a new ontology that has been shown to be more effective by OntoQA evaluation framework. We used our AR method to reconstruct the architecture of an ARM-based trusted execution environment and a Raspberry Pi platform, widely used in embedded systems and IoT devices.

Rootkit's main goal is to hide itself and other modules present in the malware. Their stealthy nature has made their detection further difficult, especially in the case of kernel-level rootkits. There have been many dynamic analysis techniques proposed for detecting kernel-level rootkits, while on the other hand, static analysis has not been popular. This is perhaps due to its poor performance in detecting malware in general, which could be attributed to the level of obfuscation employed in binaries which make static analysis difficult if not impossible. In this paper, we make two important observations, first there is usually little obfuscation used in legitimate kernel-level code, as opposed to the malicious kernel-level code. Second, one of the main approaches to penetrate the Windows operating system is through kernel-level drivers. Therefore, by focusing on detecting malicious kernel drivers employed by the rootkit, one could detect the rootkit while avoiding the issues with current detection technique. Given these two observation, we propose a simple static analysis technique with the aim of detecting malicious driver. We first study the current trends in the implementation of kernel-level rookits. Afterward, we proposed a set of features to quantify the malicious behavior in kernel drivers. These features are then evaluated through a set of experiments on 4420 malicious and legitimate drivers, obtaining an accuracy of 98.15% in distinguishing between these drivers.