SYSTEM AND METHOD FOR KERNEL ROOTKIT PROTECTION IN HYPERVISOR ENVIRONMENT

摘要

PROBLEM TO BE SOLVED: To provide a system and method for kernel rootkit protection in a hypervisor environment.SOLUTION: A system includes; a module for creating a soft whitelist 38 having entries corresponding to each guest kernel page 30 in a guest operating system 18 in a hypervisor environment; a module 40 for generating a page fault when an access attempt is made to a guest kernel page 30; a module for fixing the page fault to allow access and execution if the guest kernel page 30 corresponds to one of the entries in the soft whitelist 38; and a module for denying execution if the guest kernel page 30 does not correspond to any of the entries in the soft whitelist.SELECTED DRAWING: Figure 1