# H-KPP: Hypervisor-Assisted Kernel Patch Protection
## 6 Related Work
Unlike PrivGuard, H-KPP's protection cannot be circumvented by an attacker with kernel-mode privileges. In addition, H-KPP does not introduce any modifications to the kernel. DLP-Visor [20] is a hypervisor-based system that attempts to prevent leakage of personal data by blocking the execution of certain system calls. DLP-Visor analyzes the system call execution at the level of the kernel itself. DLP-Visor's approach to limiting kernel object modification is based on access rights of user-mode application. Unlike DLP-Visor, H-KPP limits only direct modification of kernel object; all indirect modifications are allowed. Volatility [8] is an offline tool for forensic investigation of memory snapshots. Obtaining a memory snapshot is not an easy task. ForenVisor [31], HyperSleuth [32] are two hypervisors that are capable of performing precise memory acquisition. [PERSON] et al. [33] described an adaptation of these ideas to modern operating systems. Volatility includes multiple verification mechanisms intended to recognize malicious actions that were captured in the memory snapshot. H-KPP's kernel object verification procedure follows the lines of Volatility. Unlike Volatility, H-KPP can recognize an attack while it is being conducted. [PERSON], [PERSON], and [PERSON] proposed iCruiser [34] to protect link-based data structures of the kernel. iCruiser uses a special canary embedded in the linked objects to verify the integrity of the links. iCruiser requires recompilation of the kernel. In contrast, H-KPP's verification is not limited to link-based data structures and does not require kernel recompilation. [PERSON], [PERSON], and [PERSON] proposed [35] to use a hypervisor to protect variables and structure fields from malicious modification. While the approach of the described system is more general than H-KPP's, to keep an acceptable performance degradation, the authors propose to partition the memory of kernel objects into protected and non-protected halves. This partition, obviously, requires kernel recompilation. [PERSON] et al. [36] described a so-called \"evolutionary\" attack method on kernel objects that could not be recognized by traditional means. As an example of the attack's applicability, the authors could prevent the execution of a particular process without removing it from the process list. [PERSON] et al. described a hypervisor-based system that could be used to detect such attacks. While the current implementation of H-KPP is vulnerable to evolutionary attacks, it can be augmented with the simulator described by [PERSON] et al. HUKO [37] introduces the notion of \"subject-aware protection\". HUKO defines three subjects: the kernel, a trusted kernel module, an untrusted kernel module. The kernel is permitted to perform any operation on a kernel object. Trusted kernel modules are permitted to perform only some operations. Untrusted kernel modules are permitted to perform only a tiny subset of operations. HUKO's object labeling mechanism relies on information delivered to it from the modified Linux kernel. H-KPP is similar to HUKO in that they both utilize a separate SLAT for each environment. Unlike H-KPP, HUKO is based on Xen, a full hypervisor. As a result, the HUKO's performance is not better than the performance of Xen.