1. Software Integrity Monitoring Using Hardware Performance Counters Corey Malone

2. Software Integrity Software that runs as it was originally “designed” or “compiled” At load – verify hash Runtime – Check every jump – Follow the control flow graph

3. Performance Counters Measure events such as ins retired, cache accesses, etc Already on most processors Give “insight” into processor state  program execution 1 1 3 3 7 7 0 0 9 9

4. Simple Model for Integrity Checking Profile application using counters At completion….compare to see if within certain range, to generate a probability of compromise. EXPECTED ACTUAL 0 2000 Instructions Retired Acceptable Range

5. Whole Program Monitoring NP-Complete, Very hard to do “Insight” into program not fine enough Lots of false positives.. So now what? main() { …… } main() { …… }

6. foo() { …… } foo() { …… } Function Monitoring Look at a smaller part of a program or kernel Fixed inputs to function lead to less variation Still have other variables, such as program or system status

7. System Call Monitoring for Rootkit Detection w/Terry Wang System calls commonly modified for rootkits – Hide files – Hide processes – Read files as they opened A VMM could monitor guest system calls to determine if any major variation occurs

8. Current Status X86 Implementation Complete ARM/Android Platform Research Progress – Sys Calls Guest & VMM – ARM performance counters less mature SmartGrid Proposal in Final Stages

9. Questions ?