Browse > Article
http://dx.doi.org/10.3837/tiis.2020.05.012

AIT: A method for operating system kernel function call graph generation with a virtualization technique  

Jiao, Longlong (Information System & Security and Countermeasures Experiments Center, Beijing Institute of Technology)
Luo, Senlin (Information System & Security and Countermeasures Experiments Center, Beijing Institute of Technology)
Liu, Wangtong (Information System & Security and Countermeasures Experiments Center, Beijing Institute of Technology)
Pan, Limin (Information System & Security and Countermeasures Experiments Center, Beijing Institute of Technology)
Publication Information
KSII Transactions on Internet and Information Systems (TIIS) / v.14, no.5, 2020 , pp. 2084-2100 More about this Journal
Abstract
Operating system (OS) kernel function call graphs have been widely used in OS analysis and defense. However, most existing methods and tools for generating function call graphs are designed for application programs, and cannot be used for generating OS kernel function call graphs. This paper proposes a virtualization-based call graph generation method called Acquire in Trap (AIT). When target kernel functions are called, AIT dynamically initiates a system trap with the help of a virtualization technique. It then analyzes and records the calling relationships for trap handling by traversing the kernel stacks and the code space. Our experimental results show that the proposed method is feasible for both Linux and Windows OSs, including 32 and 64-bit versions, with high recall and precision rates. AIT is independent of the source code, compiler and OS kernel architecture, and is a universal method for generating OS kernel function call graphs.
Keywords
Function call graph; operating system kernel; virtualization; system trap;
Citations & Related Records
Times Cited By KSCI : 2  (Citation Analysis)
연도 인용수 순위
1 T. R. Toma and M. S. Islam, "An efficient mechanism of generating call graph for Javascript using dynamic analysis in web application," in Proc. of 2014 International Conference on Informatics, Electronics & Vision (ICIEV), Dhaka, Bangladesh, pp. 1-6, 23-24 May 2014.
2 X.-Y. Sun and W.-Y. Zeng, "Research on sequence of function calls based on gprof," Microcomputer Information, vol. 26, no. 36, pp. 165-166, 2010.
3 M. Chabbi, X. Liu, and J. Mellor-Crummey, "Call paths for pin tools," in Proc. of Annual IEEE/ACM International Symposium on Code Generation and Optimization, Orlando, FL, USA, pp. 76-86, 15-19 February 2014.
4 A. Feldthaus, M. Schafer, M. Sridharan, J. Dolby, and F. Tip, "Efficient construction of approximate call graphs for Javascript IDE services," in Proc. of 2013 35th International Conference on Software Engineering, CA, USA, pp. 752-761, San Francisco, 18-26 May 2013.
5 F. Zyulkyarov, T. Harris, O. S. Unsal, A. Cristal, and M. Valero, "Debugging programs that use atomic blocks and transactional memory," ACM Sigplan Notices, vol. 45, no. 5, pp. 57-66, 2010.   DOI
6 SystemTap, "Systemtap wiki," 2019.
7 N. A. Carvalho and J. Pereira, "Measuring software systems scalability for proactive data center management," in Proc. of On the Move to Meaningful Internet Systems: OTM 2010, Hersonissos, Crete, Greece, pp. 829-842, 25-29 October, 2010.
8 D. de Oliveira and R. S. de Oliveira, "Comparative analysis of trace tools for real-time Linux," IEEE Latin America Transactions, vol. 12, no. 6, pp. 1134-1140, 2014.   DOI
9 R. Jalan and A. Kejariwal, "Trin-trin: Who's calling? A pin-based dynamic call graph extraction framework," International Journal of Parallel Programming, vol. 40, no. 4, pp. 410-442, 2012.   DOI
10 O. Levi, "Pin - A dynamic binary instrumentation tool," 2018.
11 B. Gregg, "Linux performance profiling tool perf," 2018.
12 R. K. Barik, R. K.Lenka, K. R. Rao, and D. Ghose, "Performance analysis of virtual machines and containers in cloud computing," in Proc. of 2016 International Conference on Computing, Communication and Automation, Noida, India, pp. 1204-1210, 29-30 April, 2016.
13 R. Di Pietro and F. Lombardi, "Virtualization technologies and cloud security: Advantages, issues, and perspectives," From Database to Cyber Security, Springer, Cham, pp. 166-185, 2018.
14 A. Damodaran, F. Di Troia, C. A. Visaggio, T. H. Austin, and M. Stamp, "A comparison of static, dynamic, and hybrid analysis for malware detection," Journal of Computer Virology and Hacking Techniques, vol. 13, no. 1, pp. 1-12, 2017.   DOI
15 T.Y. Win, H. Tianfield, and Q. Mair, "Big data based security analytics for protecting virtualized infrastructures in cloud computing," IEEE Transactions on Big Data, vol. 4, no. 1, pp. 11-25, 2017.   DOI
16 A. Singh and K. Chatterjee, "Cloud security issues and challenges: A survey," Journal of Network and Computer Applications, vol. 79, pp. 88-115, 2017.   DOI
17 C.-T. Yang, J.-C. Liu, C.-H. Hsu, and W.-L. Chou, "On improvement of cloud virtual machine availability with virtualization fault tolerance mechanism," Journal of Supercomputing, vol. 69, no. 3, pp. 1103-1122, 2014.   DOI
18 S. Ribic and A. Salihbegovic, "Tiny operating system kernel for education purposes," in Proc. of 38th International Convention on Information and Communication Technology, Electronics and Microelectronics, Opatija, Croatia, pp. 700-705, 25-29 May 2015.
19 O. S. Hofmann, A. M. Dunn, S. Kim, I. Roy, and E. Witchel, "Ensuring operating system kernel integrity with OSck," ACM SIGPLAN Notices, vol. 46, no. 3, pp. 279-290, 2011.   DOI
20 S. Eresheim, R. Luh, and S. Schrittwieser, "The evolution of process hiding techniques in malware-current threats and possible countermeasures," Journal of Information Processing, vol. 25 no.1, pp. 866-874, 2017.   DOI
21 C. Cui, Y. Wu, Y. Li, et al., "Lightweight intrusion detection of rootkit with VMI-based driver separation mechanism," KSII Transactions on Internet & Information Systems, vol. 11, no.3, pp. 1722-1741, 2017.   DOI
22 R. Patil and C. Modi, "An exhaustive survey on security concerns and solutions at different components of virtualization," ACM Computing Surveys, vol. 52, no. 1, p. 12, 2019.
23 A. Lee, A. Payne , and T. Atkison, "A review of popular reverse engineering tools from a novice perspective," in Proc. of the International Conference on Software Engineering Research and Practice, Las Vegas, Nevada, USA, pp. 68-74, 30 July-2 August 2018.
24 P. Bhat and K. Dutta, "A survey on various threats and current state of security in Android platform," ACM Computing Surveys, vol. 52, no. 1, p. 21, 2019.
25 R. Luh, H. Janicke, and S. Schrittwieser, "AIDIS: Detecting and classifying anomalous behavior in ubiquitous kernel processes," Computers & Security, vol. 84, pp. 120-147, 2019.   DOI
26 A. Arusoaie, S. Ciobaca, V. Craciun, et al., "A comparison of open-source static analysis tools for vulnerability detection in C/C++ code," in Proc. of 19th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing, Timisoara, Romania, pp. 161-168, 21-24 September 2017.