DROS-PGM: Deterministic Kernel-Level Execution Control for Post-Compromise Security

Abstract—Modern operating systems rely on identityand network-centric security models, which fail underpost-authentication compromise scenarios. Existing defenses (EDR/XDR, IAM, ZTNA) are inherently reactive and probabilistic, leaving a temporal gap between execution and detection. We present DROS-PGM, a kernel-level security architecture that introduces a third trust primitive—Execution Trust— to enforce deterministic, non-probabilistic control over system call execution. DROS-PGM operates at sub-microsecond latency (≈ 353 ns) using a decoupled three-plane model consisting of enforcement, telemetry, and cryptographic attestation.Unlike traditional detection-based systems (e.g., EDR/XDR), DROS-PGM enforces security invariants inline at the system call boundary, ensuring that unauthorized operations are blocked before execution. We further introduce a cryptographically accountable runtime substrate based on append-only telemetry logs and Merkle tree-based batch attestation. Experimental results demonstrate 100% containment of ransomware encryption, data exfiltration, and privilege escalation attempts under controlled adversarial workloads, while maintaining SPEC CPU2017 baseline performance with negligible overhead (< 2%). 現代企業安全架構主要依賴基於身份(IAM)和網絡(ZTNA)的信任模型。然而,一旦進程通過身份驗證或遭受劫持,這些機制便無法在執行層提供確定性的安全強制。我們提出了DROS-PGM,一種內核級安全架構,它引入了第三種安全原語「執行信任(Execution Trust) 」對系統呼叫(Syscall)的執行實施確定性、非概率性的控制。DROS-PGM 通過將執行強制、日誌遙測和密碼學證明解耦的三平面模型,在亞微秒級延遲(≈ 353 ns)下運行。與傳統基於檢測的系統(EDR/XDR)不同,DROS-PGM 在系統呼叫邊界帶內(inline)強制執行安全不變量,確保未授權的操作在執行前即被阻斷。我們進一步引入了一種基於僅可追加(append-only)遙測日誌和梅克爾樹(Merkle Tree)批次證明的可密碼學審證的運行期物理基底。實驗結果表明,在受控的對抗工作負載(1,000 次迭代)下,系統100% 阻斷了勒索軟體加密、大宗數據外洩和特權提升攻擊,同時以極低的系統開銷(< 2%)維持了線速(Wire-speed)系統效能(達致952,991 QPS),且誤報率(FPR)= 0.00%。