ULTRA: Ultimate Rootkit Detection over the Air - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

ULTRA: Ultimate Rootkit Detection over the Air

Résumé

Rootkits are the most challenging malware threats against server and desktop systems. They are created by highly skilled actors and are deployed in advanced persistent threat attacks. Lately and even in the future, rootkits will become a real threat to billions of IoT devices. Existing malware detection techniques based on static or dynamic analysis face major shortcomings, which become more apparent when it is necessary to detect threats on IoT devices. In this paper, we propose the ULTRA framework, which can detect rootkits effectively and efficiently by operating outside of the "box" (literary device) with no resource requirement on the target device. ULTRA baits the rootkit to provoke activity, measures electromagnetic emanation with a software-defined radio, preprocesses signals, then detects and classifies rootkit behavior using machine/deep learning techniques. As use cases, we target two IoT devices with MIPS and ARM architectures. The proposed approach achieved promising results with high accuracy for detecting both known and unknown rootkits during the offline learning phase. Our experimental study involves classification of rootkit families and distinct variants, obfuscated rootkits, probe dislocation, benign noise (kernel) activities, and comparison with software-based solutions.
Fichier principal
Vignette du fichier
raid2002_camera_ready.pdf (20.82 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03713584 , version 1 (04-07-2022)

Identifiants

Citer

Duy-Phuc Pham, Damien Marion, Annelie Heuser. ULTRA: Ultimate Rootkit Detection over the Air. 25th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2022),, Oct 2022, Limassol, Cyprus. ⟨10.1145/3545948.3545962⟩. ⟨hal-03713584⟩
196 Consultations
221 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More