Balancing malware rootkit detection with power consumption on mobile devices
The subject disclosure presents a novel technique for balancing the tradeoff between security monitoring and energy consumption on mobile devices. Security/energy tradeoffs for host-based detectors focusing on rootkits are analyzed along two axes: a scanning frequency, and a surface of attack. Experimental results are applied to a hypervisor-based framework, and a sweet spot is identified to minimize both energy consumption and a window of vulnerability for critical operating system objects such as code pages and kernel data.
1. A method comprising:
determining, by a mobile device comprising a processor, an amount of energy consumed during a rootkit detection;
determining, by the processor, an aggregate window of vulnerability for the mobile device, the aggregate window of vulnerability being based on a plurality of windows of vulnerability for a corresponding plurality of pages on a memory of the mobile device; and
adjusting, by the processor, one of a frequency or an attack surface of the rootkit detection based in part on the aggregate window of vulnerability and the amount of energy consumed.
2. The method of claim 1 , further comprising comparing the amount of energy consumed with a maximum threshold and a minimum threshold.
3. The method of claim 2 , wherein the frequency and the attack surface are increased when the amount of energy consumed is below the minimum threshold.
4. The method of claim 2 , wherein the frequency and the attack surface are decreased when the amount of energy consumed is below the minimum threshold.
5. The method of claim 1 , further comprising:
generating a shadow page table on a hypervisor on the memory;
recording a modification of a kernel data page on the hypervisor; and
detecting for rootkits on the modified kernel data page.
6. The method of claim 1 , wherein adjusting the frequency of rootkit detection comprises one or more of defining a period between detection and defining an event to trigger a detection, wherein the event comprises reaching a quota of pages that are undetected.
7. The method of claim 1 , wherein adjusting the frequency of rootkit detection further comprises batch processing a plurality of events at a completion of one or more of a batch period and a batch amount.
8. The method of claim 7 , wherein each window of vulnerability comprises a function of one or more of the period between detection, the batch period, and a processing time involved for each detection.
9. The method of claim 8 , wherein the frequency and attack surface are adjusted to minimize the amount of energy consumed and the window of vulnerability.
10. The method of claim 1 , wherein adjusting the attack surface comprises limiting the rootkit detection to one or more of: executable code pages, root processes, function pointers, kernel data pages, or static data.
11. The method of claim 1 , further comprising providing a user interface to adjust the frequency of detection and the attack surface.
12. The method of claim 9 , further comprising randomizing one or both of the frequency or the attack surface.
13. A non-transitory tangible computer-readable medium having stored thereon instructions that, when executed by a processor, cause the processor to perform operations comprising:
determining an amount of energy consumed during a rootkit detection, on a mobile device;
determining an average window of vulnerability for a plurality of rootkit detections of a plurality of pages on the mobile device; and
adjusting one of a frequency or an attack surface of the rootkit detection based in part on the aggregate window of vulnerability and the amount of energy consumed.
14. The non-transitory tangible computer-readable medium of claim 13 , further comprising comparing the amount of energy consumed with a maximum threshold and a minimum threshold.
15. The non-transitory tangible computer-readable medium of claim 14 , wherein the frequency and the attack surface are increased when the amount of energy consumed is below the minimum threshold.
16. The non-transitory tangible computer-readable medium of claim 15 , wherein the frequency and the attack surface are decreased when the amount of energy consumed is below the minimum threshold.
17. A mobile device, comprising:
a processor; and
a memory in communication with the processor, the memory to store instructions that, when executed by the processor, cause the processor to perform operations comprising:
determining an amount of energy consumed during a rootkit detection;
adjusting a frequency of the rootkit detection; and
adjusting an attack surface to be detected during the rootkit detection;
wherein the adjustments are based in part on an aggregate window of vulnerability and the amount of energy consumed, the aggregate window of vulnerability being based on a plurality of windows of vulnerability for a corresponding plurality of rootkit detections.
18. The mobile device of claim 17 , further comprising a database on the trusted domain, the database storing one or both of a whitelist and a table of invariants, the whitelist comprising a table of hashes for all binaries within the guest domain.
19. The mobile device of claim 17 , wherein the operations further comprise measuring a power level of a battery to determine the energy consumed.
20. The mobile device of claim 17 , further comprising a hardware slider coupled to the mobile device to enable adjustment of the frequency and the attack surface.