Snoop-based kernel integrity monitoring apparatus and method thereof

A snoop-based kernel integrity monitoring method comprising:

• determining an address of a kernel immutable region by obtaining information from a host system through a bridge after the host system is booted;
• recording the determined address of the kernel immutable region in a snooper which is connected to a system bus of the host system;
• snooping traffic occurring in the system bus of the host system through the snooper;
• detecting a write attempt in the kernel immutable region in the snooped traffic;
• and
• if a write attempt in the kernel immutable region is detected, generating a warning message including information on the detected write attempt in the kernel immutable region.

A snoop-based kernel integrity monitoring apparatus comprising:

• a snooper which stores an address of a monitoring region in which any modification is capable of violating integrity of an operating system, snoops traffic occurring in a system bus of a host system, and detects a write attempt in the monitoring region among the snooped traffic;
• and
• a verification unit which if a write attempt in the monitoring region is detected, generates a warning message including information on the detected write attempt in the monitoring region,
• wherein the monitoring region comprises:
• a preselected region which is preselected in a kernel mutable region;
• and
• a kernel immutable region.

A snoop-based kernel integrity monitoring method comprising:

• determining an address of a monitoring region which is capable of violating integrity of an operating system, by obtaining information through a bridge from a host system;
• recording the address of the monitoring region in a snooper connected to a system bus of the host system;
• snooping traffic occurring in the system bus of the host system through the snooper;
• detecting a write attempt in the monitoring region in the snooped traffic;
• and
• if a write attempt in the monitoring region is detected, generating a warning message including information on the detected write attempt in the monitoring region,
• wherein the monitoring region comprises:
• a preselected region which is preselected in a kernel mutable region;
• and
• a kernel immutable region.