Identification of Privilege Escalation Attack Using Kernel Monitoring Mechanism

Privilege escalation attacks through memory corruption via kernel vulnerabilities pose a significant threat to operating systems. Although the extended Berkeley packet filter has been used to trace kernel code execution, it does not trace operations before and after kernel data writes. This prevents effective monitoring of privileged information. In this paper, we introduce a kernel data monitor (kdMonitor), which is a novel security mechanism designed to detect unauthorized changes to the monitored privileged information of a dedicated kernel page. kdMonitor contains two different methods. The first is periodic monitoring, which periodically outputs the monitored privileged information of the dedicated kernel pages. The second is dynamic monitoring, which restricts write access to a dedicated kernel page, and supplements any writes with page faults. To keep the kernel stability, kdMonitor allows the write access after page faults then outputs the monitored privileged information of dedicated kernel pages. kdMonitor enables real-time tracking of privileged information of the dedicated kernel page residing in the kernel memory from the separated machine. Using kdMonitor, we demonstrated its capability to detect privilege escalation attacks on the running kernel. Through an empirical evaluation, we validated the effectiveness of kdMonitor in detecting privilege escalation attacks by user processes on the Linux kernel. Performance evaluations showed that kdMonitor achieved an attack detection time of 0.834 seconds with a kernel overhead of 0.726% and web application overhead was 0.28%.