A Review on Learning-based Detection Approaches of the Kernel-level Rootkit

Tracing is a popular method for evaluating, investigating, and modeling the performance of today's storage systems. Tracing has become crucial with the increase in complexity of modern storage applications/systems, that are manipulating an ever-increasing amount of data and are subject to extreme performance requirements. There exists many tracing tools focusing either on the user-level or the kernel-level, however we observe the lack of a unified tracer targeting both levels: this prevents a comprehensive understanding of modern applications' storage performance profiles. In this paper, we present EZIOTracer, a unified I/O tracer for both (Linux) kernel and user spaces, targeting data intensive applications. EZIOTracer is composed of a userland as well as a kernel space tracer, complemented with a trace analysis framework able to merge the output of the two tracers, and in particular to relate user-level events to kernel-level ones, and vice-versa. On the kernel side, EZIOTracer relies on eBPF to offer safe, low-overhead, low memory footprint, and flexible tracing capabilities. We demonstrate using FIO benchmark the ability of EZIOTracer to track down I/O performance issues by relating events recorded at both the kernel and user levels. We show that this can be achieved with a relatively low overhead that ranges from 2% to 26% depending on the I/O intensity.

Download Full-text

A New Real-Time Process Monitor Method Based on MRC

Advanced Materials Research ◽

10.4028/www.scientific.net/amr.971-973.1481 ◽

2014 ◽

Vol 971-973 ◽

pp. 1481-1484

Author(s):

Ke He Wu ◽

Long Chen ◽

Yi Li

Keyword(s):

Information System ◽

Real Time ◽

Process Monitoring ◽

Time Process ◽

Monitoring Methods ◽

Traditional Process ◽

Kernel Level ◽

Process Monitor

In order to ensure safe and stable running of applications, this paper analyses the limitation of traditional process-monitoring methods, and then designs a new real-time process monitor method based on Mandatory Running Control (MRC) technology. This method not only can monitor the processes, but also can control them from system kernel level to improve the reliability and safety of applications, so as to ensure the security and stability of information system.

Download Full-text

CP-NAS: Child-Parent Neural Architecture Search for 1-bit CNNs

Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence ◽

10.24963/ijcai.2020/144 ◽

2020 ◽

Author(s):

Li'an Zhuo ◽

Baochang Zhang ◽

Hanlin Chen ◽

Linlin Yang ◽

Chen Chen ◽

...

Keyword(s):

Computational Cost ◽

Unified Framework ◽

Embedded Devices ◽

Natural Approach ◽

Neural Architecture ◽

Resource Limited ◽

Training Stage ◽

Comparable Accuracy ◽

Kernel Level ◽

High Computational Cost

Neural architecture search (NAS) proves to be among the best approaches for many tasks by generating an application-adaptive neural architectures, which are still challenged by high computational cost and memory consumption. At the same time, 1-bit convolutional neural networks (CNNs) with binarized weights and activations show their potential for resource-limited embedded devices. One natural approach is to use 1-bit CNNs to reduce the computation and memory cost of NAS by taking advantage of the strengths of each in a uniﬁed framework. To this end, a Child-Parent model is introduced to a differentiable NAS to search the binarized architecture(Child) under the supervision of a full-precision model (Parent). In the search stage, the Child-Parent model uses an indicator generated by the parent and child model accuracy to evaluate the performance and abandon operations with less potential. In the training stage, a kernel level CP loss is introduced to optimize the binarized network. Extensive experiments demonstrate that the proposed CP-NAS achieves a comparable accuracy with traditional NAS on both the CIFAR and ImageNet databases. It achieves an accuracy of 95.27% on CIFAR-10, 64.3% on ImageNet with binarized weights and activations, and a 30% faster search than prior arts.

Download Full-text