# JITScanner: Just-in-Time Executable Page Check in the Linux Operating System +
## 2 Related Work  
The literature on techniques for detecting malicious software is very ample. One trend consists of the exploitation of machine learning techniques in order to identify malware components in both traditional [10] and cloud oriented platforms [11]. Compared to all these techniques, our solution is essentially orthogonal, since we focus on a low-level service for deferring (or hopefully avoiding) the check of a given virtual page content along time, which can be implemented also according to machine learning techniques exploiting some knowledge base on malicious executable-page signatures. Memory forensic analysis relies on memory images, such as VM (Virtual Machine) images, to deduce the potential existence of malicious software or applications [12; 13]. While certain techniques aim to reduce the number of memory checks required, this approach fundamentally differs from our proposal. Our approach is centered on bypassing checks on non-materialized pages, which are still present within the file systems or VM dumps analyzed by memory forensic techniques. Additionally, our solution addresses encrypted code that dynamically undergoes decryption at a granular level and is installed on an executable page within the address space. In contrast, memory forensics solutions typically conduct checks at a coarser level since events of interest, such as API calls, lead to memory dumps that are not immediate. Consequently, the transient content of memory before the actual dump is not actively tracked within these solutions. The distinction lies in our ability to focus on non-materialized pages and handle dynamically decrypted code at a fine granularity, which sets our approach apart from traditional memory forensics methods. Our approach fundamentally differs from any static checker, such as ClamAV [14], because we specifically aim to avoid checking the entire image of a program. Instead, we provide the capability for dynamic checks at runtime, even accommodating WX (Write-Execute) pages loaded into an application's address space. While certain antivirus tools perform operations during runtime as well [15], they do not utilize the kernel-level technique that we introduce, nor do they possess the capability to manage the virtualization of access permissions to critical pages, such as WX pages, as we do through our shadow state machine. Recent studies have shown that common antivirus tools can be circumvented by software that intelligently utilizes these types of pages within an application's address space [9]. These attacks often involve materializing critical binary code into these pages at a later time, for instance, by decrypting code in such a page during runtime--a tactic that can be directly countered by leveraging our solution. Indeed, the detection of malicious software often involves behavioral analysis of applications, achieved through methods such as intercepting library calls or system calls. Antivirus solutions employing dynamic analysis [15] and eBPF (Extended Berkeley Packet Filter) kernel-level solutions [16; 17] typically follow this paradigm. This form of behavioral analysis operates independently from (and can be combined with) our approach because it does not specifically target the identification of signatures within code hosted on executable pages, as our solution does. Furthermore, our approach factors in the dynamic decryption of code blocks, which is a distinct focus compared to the behavioral analysis employed by these solutions. Various operating system security solutions aim to enhance the robustness in managing an application's address space. For instance, some approaches involve making user-level pages inaccessible for instruction fetching when operating in kernel mode, as seen in solutions such as KPTI (Kernel Page-Table Isolation) [18]. However, these approaches remain distinct and separate from our solution. The primary focus of these methods is to mitigate risks associated with running kernel-level software.