Study on Information Security Monitoring Framework

摘要

As malware has become increasingly sophisticated over the past several years, it is no longer unusual to see it disable critical security services on a victim's machine. In our threat model, we assume the attacker can compromise the user's OS and any application running inside it. The results show that our threat model makes an introspection assumption stating that the OS and application level data structures in the User VM memory have not been altered, it is still instructive to consider what it would take to perform this type of attack, and the most security critical data is located in the User OS kernel.