Scanning kernel data structure characteristics
AssigneeAmazon Technologies, Inc.
InventorNicholas Alexander Allen
Life of this patent
Estimating the term…
Abstract
A method and apparatus for detecting kernel data structure tampering are disclosed. In the method and apparatus, a memory region of a computer system is scanned for one or more characteristics of a kernel data structure of an operating system kernel. It is then determined, based at least in part on identifying whether the one or more characteristics are found in the memory region, whether the kernel data structure is stored in the memory region of the computer system for tampering with the kernel data structure.
Claims20
A computer implemented method, comprising:
- obtaining, from a data store that stores characteristics of data structures associated with an operating system kernel, a characteristic of data associated with a data structure of the operating system kernel, the characteristic of data indicating a value associated with a bit position of the data structure of the operating system kernel;
- generating a snapshot of memory of a virtual machine;
- scanning the snapshot to generate a determination that the characteristic of data is outside of a protected area of the memory;
- and
- determining, based at least in part on the determination, that the operating system kernel is compromised.
A system, comprising:
- one or more processors;
- and
- memory to store instructions that, as a result of being executed by the one or more processors, cause the system to:
- obtain, from a data store, a characteristic associated with an operating system kernel, the characteristic indicating a value associated with a field of a data structure of the operating system kernel;
- identify the characteristic in a memory region outside of a protected area by at least scanning a snapshot of the memory region for the characteristic;
- and
- determine that the operating system kernel is compromised based at least in part on identifying the characteristic.
A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to:
- retrieve a characteristic associated with an operating system kernel from a data store, the characteristic indicating a value associated with a field of a data structure associated with the operating system kernel;
- detect, in a snapshot of a memory region of a virtual computer system, data with the characteristic in the memory region outside of a protected area;
- and
- determine, as a result of detecting the characteristic in the memory region outside of the protected area, that the operating system kernel is compromised.
Dependencies are inferred from the claim text.