Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware Activity
Obfuscation and cryptography technologies are applied to malware to make the detection of malware through intrusion prevention systems (IPSs), intrusion detection systems (IDSs), and antiviruses difficult. To address this problem, the security requirements for post-detection and proper response are...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-06-01
|
| Series: | Electronics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2079-9292/11/12/1871 |
| _version_ | 1797487993801408512 |
|---|---|
| author | Sung-Hwa Han Daesung Lee |
| author_facet | Sung-Hwa Han Daesung Lee |
| author_sort | Sung-Hwa Han |
| collection | DOAJ |
| description | Obfuscation and cryptography technologies are applied to malware to make the detection of malware through intrusion prevention systems (IPSs), intrusion detection systems (IDSs), and antiviruses difficult. To address this problem, the security requirements for post-detection and proper response are presented, with emphasis on the real-time file access monitoring function. However, current operating systems provide only file access control techniques, such as SELinux (version 2.6, Red Hat, Raleigh, NC, USA) and AppArmor (version 2.5, Immunix, Portland, OR, USA), to protect system files and do not provide real-time file access monitoring. Thus, the service manager or data owner cannot determine real-time unauthorized modification and leakage of important files by malware. In this paper, a structure to monitor user access to important files in real time is proposed. The proposed structure has five components, with a kernel module interrelated to the application process. With this structural feature, real-time monitoring is possible for all file accesses, and malicious attackers cannot bypass this file access monitoring function. By verifying the positive and negative functions of the proposed structure, it was validated that the structure accurately provides real-time file access monitoring function, the monitoring function resource is sufficiently low, and the file access monitoring performance is high, further confirming the effectiveness of the proposed structure. |
| first_indexed | 2024-03-09T23:56:43Z |
| format | Article |
| id | doaj.art-af66339607044b8b806df7db3a08be6a |
| institution | Directory Open Access Journal |
| issn | 2079-9292 |
| language | English |
| last_indexed | 2024-03-09T23:56:43Z |
| publishDate | 2022-06-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Electronics |
| spelling | doaj.art-af66339607044b8b806df7db3a08be6a2023-11-23T16:25:06ZengMDPI AGElectronics2079-92922022-06-011112187110.3390/electronics11121871Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware ActivitySung-Hwa Han0Daesung Lee1Department of Information Security, Tongmyong University, Busan 48520, KoreaDepartment of Computer Engineering, Catholic University of Pusan, Busan 46252, KoreaObfuscation and cryptography technologies are applied to malware to make the detection of malware through intrusion prevention systems (IPSs), intrusion detection systems (IDSs), and antiviruses difficult. To address this problem, the security requirements for post-detection and proper response are presented, with emphasis on the real-time file access monitoring function. However, current operating systems provide only file access control techniques, such as SELinux (version 2.6, Red Hat, Raleigh, NC, USA) and AppArmor (version 2.5, Immunix, Portland, OR, USA), to protect system files and do not provide real-time file access monitoring. Thus, the service manager or data owner cannot determine real-time unauthorized modification and leakage of important files by malware. In this paper, a structure to monitor user access to important files in real time is proposed. The proposed structure has five components, with a kernel module interrelated to the application process. With this structural feature, real-time monitoring is possible for all file accesses, and malicious attackers cannot bypass this file access monitoring function. By verifying the positive and negative functions of the proposed structure, it was validated that the structure accurately provides real-time file access monitoring function, the monitoring function resource is sufficiently low, and the file access monitoring performance is high, further confirming the effectiveness of the proposed structure.https://www.mdpi.com/2079-9292/11/12/1871real-time monitoringhidden malwarefile access monitoringkernel-based structureaccess controlendpoint detection and response |
| spellingShingle | Sung-Hwa Han Daesung Lee Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware Activity Electronics real-time monitoring hidden malware file access monitoring kernel-based structure access control endpoint detection and response |
| title | Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware Activity |
| title_full | Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware Activity |
| title_fullStr | Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware Activity |
| title_full_unstemmed | Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware Activity |
| title_short | Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware Activity |
| title_sort | kernel based real time file access monitoring structure for detecting malware activity |
| topic | real-time monitoring hidden malware file access monitoring kernel-based structure access control endpoint detection and response |
| url | https://www.mdpi.com/2079-9292/11/12/1871 |
| work_keys_str_mv | AT sunghwahan kernelbasedrealtimefileaccessmonitoringstructurefordetectingmalwareactivity AT daesunglee kernelbasedrealtimefileaccessmonitoringstructurefordetectingmalwareactivity |