title: ÐÐ±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð¾Ð¿Ð°ÑÐ½Ð¾Ð³Ð¾ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ Ð¼Ð¾Ð´ÑÐ»ÐµÐ¹ ÑÐ´ÑÐ° Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ Windows Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ ÑÐµÑ Ð½Ð¾Ð»Ð¾Ð³Ð¸Ð¸ Ð°Ð¿Ð¿Ð°ÑÐ°ÑÐ½Ð¾Ð¹ Ð²Ð¸ÑÑÑÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Detecting dangerous behavior of Windows kernel modules using hardware virtualization technology
Creators: name: ÐÐµÐ»Ð¾Ð±ÑÐ¾Ð², ÐÐ»ÐµÐºÑÐ°Ð½Ð´Ñ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2020
Subjects: Ð¼Ð¾Ð´ÑÐ»Ð¸ ÑÐ´ÑÐ°
Ð¾Ð¿Ð°ÑÐ½Ð¾Ðµ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ
Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ¸ÑÑÐµÐ¼Ð°
Ð°Ð¿Ð¿Ð°ÑÐ°ÑÐ½Ð°Ñ Ð²Ð¸ÑÑÑÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ
Ð³Ð¸Ð¿ÐµÑÐ²Ð¸Ð·Ð¾Ñ
ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ Ð¿Ð°Ð¼ÑÑÐ¸
Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
kernel modules
dangerous behavior
operating system
hardware virtualization
hypervisor
memory control
machine learning

description: Ð Ð´Ð°Ð½Ð½Ð¾Ð¹ Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÐµ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¾ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð¿ÑÐ¾Ð±Ð»ÐµÐ¼ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¾Ð¿Ð°ÑÐ½Ð¾Ð³Ð¾ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ Ð¼Ð¾Ð´ÑÐ»ÐµÐ¹ ÑÐ´ÑÐ° ÐÐ¡ Windows. Ð Ð°ÑÑÐ¼Ð¾ÑÑÐµÐ½Ñ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½ÑÐµ ÑÐ³ÑÐ¾Ð·Ñ ÑÐ¾ ÑÑÐ¾ÑÐ¾Ð½Ñ Ð¼Ð¾Ð´ÑÐ»ÐµÐ¹ ÑÐ´ÑÐ°, Ð° ÑÐ°ÐºÐ¶Ðµ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¿Ð¾ Ð¸Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ. ÐÑÐ» Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½ Ð¼ÐµÑÐ¾Ð´ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¾Ð¿Ð°ÑÐ½Ð¾Ð³Ð¾ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ Ð¼Ð¾Ð´ÑÐ»ÐµÐ¹ ÑÐ´ÑÐ° ÐÐ¡, Ð¾ÑÐ½Ð¾Ð²Ð°Ð½Ð½ÑÐ¹ Ð½Ð° ÑÐµÑÐ½Ð¾Ð»Ð¾Ð³Ð¸Ð¸ Ð°Ð¿Ð¿Ð°ÑÐ°ÑÐ½Ð¾Ð¹ Ð²Ð¸ÑÑÑÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸ Ð¸ Ð¼ÐµÑÐ¾Ð´Ð°Ñ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ, Ð¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ ÑÐ¸ÑÑÐµÐ¼Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð°Ñ ÑÐ¸ÑÑÐµÐ¼Ð° ÑÐ¾ÑÑÐ¾Ð¸Ñ Ð¸Ð· Ð¼Ð¾Ð½Ð¸ÑÐ¾ÑÐ° Ð¿Ð°Ð¼ÑÑÐ¸, Ð¾ÑÐ½Ð¾Ð²Ð°Ð½Ð½Ð¾Ð¼ Ð½Ð° ÑÐµÑÐ½Ð¾Ð»Ð¾Ð³Ð¸Ð¸ Ð°Ð¿Ð¿Ð°ÑÐ°ÑÐ½Ð¾Ð¹ Ð²Ð¸ÑÑÑÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸ Intel VT-x, Ð¸ Ð¿Ð¾Ð·Ð²Ð¾Ð»ÑÐµÑ ÐºÐ¾Ð½ÑÑÐ¾Ð»Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð¸ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ðµ ÑÐµÐ»ÐµÐ²Ð¾Ð³Ð¾ Ð¼Ð¾Ð´ÑÐ»Ñ ÑÐ´ÑÐ° Ð´Ð»Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¾ÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÐµÐ¹ ÐµÐ³Ð¾ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ, ÑÐ°ÐºÐ¸Ñ ÐºÐ°Ðº Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð¸ ÑÑÐµÐ½Ð¸Ñ, Ð·Ð°Ð¿Ð¸ÑÐ¸ Ð¸ Ð¸ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ð² Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ð½ÑÑ ÑÑÐ°ÑÑÐºÐ°Ñ Ð¿Ð°Ð¼ÑÑÐ¸, Ð¸ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°ÑÐ¾ÑÐ°, ÐºÐ¾ÑÐ¾ÑÑÐ¹ Ð¿ÑÐ¸Ð¼ÐµÐ½ÑÐµÑ Ð¼ÐµÑÐ¾Ð´Ñ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¾Ð¿Ð°ÑÐ½Ð¾Ð³Ð¾ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ. ÐÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð° Ð¼ÐµÑÐ¾Ð´Ð¸ÐºÐ° Ð¾ÑÐ±Ð¾ÑÐ° Ð²Ð°Ð¶Ð½ÑÑ ÑÑÐ½ÐºÑÐ¸Ð¹ API Windows Ð´Ð»Ñ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ Ð¼ÐµÑÑ TF-IDF. ÐÑÐ¾Ð²ÐµÐ´ÐµÐ½Ñ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÑ, Ð¿Ð¾Ð·Ð²Ð¾Ð»ÑÑÑÐ¸Ðµ Ð¾ÑÐµÐ½Ð¸ÑÑ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ ÑÐµÑÐµÐ½Ð¸Ñ, Ð² ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÐºÐ¾ÑÐ¾ÑÑÑ Ð±ÑÐ»Ð¾ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¾, ÑÑÐ¾ ÑÐ¸ÑÑÐµÐ¼Ð° ÑÐ¿Ð¾ÑÐ¾Ð±Ð½Ð° Ð²ÑÑÐ²Ð»ÑÑÑ Ð¾Ð¿Ð°ÑÐ½Ð¾Ðµ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ Ð¼Ð¾Ð´ÑÐ»ÐµÐ¹ ÑÐ´ÑÐ° ÐÐ¡ Windows Ñ Ð´Ð¾ÑÑÐ°ÑÐ¾ÑÐ½Ð¾ Ð²ÑÑÐ¾ÐºÐ¾Ð¹ ÑÐ¾ÑÐ½Ð¾ÑÑÑÑ.
description: This work presents a research of existing problems of detecting dangerous behavior of Windows kernel modules. Possible threats from kernel modules are considered, and existing methods for their detection are analyzed. A method for detecting dangerous behavior of OS kernel modules based on hardware virtualization technology and machine learning methods was proposed, and a prototype detection system was developed. The developed system consists of a memory monitor based on Intel VT-x hardware virtualization technology and allows you to monitor the execution of the target kernel module to detect specific characteristics of its behavior, such as read, write and execute operations in certain memory areas, and an analyzer that uses machine learning methods to detect dangerous behavior. The method of selecting important functions of Windows API to teach detection models using TF-IDF measure is proposed. Experiments were carried out to assess the effectiveness of the developed solution, which resulted in the discovery that the system is able to detect dangerous behavior of Windows kernel modules with sufficient accuracy.