Monitoring operating system invariant information
View Patent ↗In some examples, a system executes a monitor separate from an operating system (OS) that uses mapping information in accessing data in a physical memory. The monitor identifies, using the mapping information, invariant information, that comprises program code, of the OS without suspending execution of the OS, the identifying comprising the monitor accessing the physical memory independently of the OS. The monitor determines, based on monitoring the invariant information of the OS, whether a security issue is present.
1. A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to:
execute a monitor separate from an operating system (OS) that uses mapping information in accessing data in a physical memory, wherein the mapping information maps virtual addresses to physical addresses of the physical memory;
receive, by the monitor from an agent, metadata indicating a storage location of the mapping information;
access, by the monitor without suspending execution of the OS, the mapping information using a virtual address in the metadata, the virtual address related to invariant information comprising program code of the OS;
receive, by the monitor, a physical address translated by the mapping information from the virtual address;
access, by the monitor, a memory location specified by the physical address to retrieve the invariant information of the OS from the physical memory independently of the OS; and
determine, by the monitor based on monitoring the invariant information of the OS, whether a security issue is present.
2. The non-transitory machine-readable storage medium of claim 1 , wherein the access of the memory location comprises the monitor accessing the physical memory directly over an interconnect independently of the OS.
3. The non-transitory machine-readable storage medium of claim 1 , wherein the metadata comprises a virtual memory map that indicates portions of a virtual address space that are assigned for respective uses by the OS, and wherein determining whether the security issue is present is further based on the virtual memory map.
4. The non-transitory machine-readable storage medium of claim 1 , wherein the metadata comprises a virtual address of critical information of the OS or of static information of the OS, wherein the invariant information monitored by the monitor comprises the critical information or the static information.
5. The non-transitory machine-readable storage medium of claim 1 , wherein the metadata comprises a page frame management data structure comprising information for page frames, wherein the invariant information monitored by the monitor comprises a page frame.
6. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the system to:
detect new executable code; and
determine that an attack is occurring responsive to:
detecting that the new executable code is corrupted based on the metadata, or
detecting that the new executable code is within or outside of a specified virtual address region.
7. The non-transitory machine-readable storage medium of claim 1 , wherein determining whether the security issue is present comprises comparing a hash value of the invariant information at runtime of the OS to a baseline hash value of the invariant information.
8. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the system to:
use a process descriptor to verify an integrity of an OS process.
9. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the system to:
detect a hidden process by comparing entries of a first list that lists all processes with entries of a second list that lists scheduled processes.
10. A system comprising:
a physical memory;
a first processor;
a second processor;
an operating system (OS) executable on the first processor, the OS to use mapping information in accessing data in the physical memory, wherein the mapping information maps virtual addresses to physical addresses of the physical memory;
a monitor executable on the second processor that is different from the first processor to:
receive, from an agent, metadata indicating a storage location of the mapping information;
access, without suspending execution of the OS, the mapping information using a virtual address in the metadata, the virtual address related to invariant information comprising program code of the OS;
receive, at the monitor, a physical address translated by the mapping information from the virtual address;
access a memory location specified by the physical address to retrieve the invariant information of the OS from the physical memory independently of the OS; and
determine, based on monitoring the invariant information of the OS, whether a security issue is present.
11. The system of claim 10 , wherein the metadata comprises a virtual memory map that indicates portions of a virtual address space that are assigned for respective uses by the OS, and wherein determining whether the security issue is present is further based on the virtual memory map.
12. The non-transitory machine-readable storage medium of claim 1 , wherein executing the monitor separately from the OS comprises executing the monitor on a first processor and executing the OS on a second processor.
13. The non-transitory machine-readable storage medium of claim 1 , wherein the OS includes a hypervisor, and the determining comprises determining whether the security issue is present with the hypervisor, and wherein the monitor is a non-hypervisor-based monitor.
14. The non-transitory machine-readable storage medium of claim 1 , wherein the monitoring of the invariant information is performed without making a copy of the mapping information.
15. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the system to:
detect an attack of the mapping information.
16. The non-transitory machine-readable storage medium of claim 15 , wherein the detecting of the attack of the mapping information is based on detecting that an entry of the mapping information has a privilege level different from a predetermined privilege level or that the entry of the mapping information has a mode different from a predetermined mode.
17. The non-transitory machine-readable storage medium of claim 1 , wherein the agent is part of the OS.
18. The system of claim 10 , wherein the monitor is executable on the second processor to:
detect an attack of the mapping information.
19. The system of claim 18 , wherein the detecting of the attack of the mapping information is based on detecting that an entry of the mapping information has a privilege level different from a predetermined privilege level or that the entry of the mapping information has a mode different from a predetermined mode.