A4 Article in conference proceedings
Diversification of System Calls in Linux Kernel

List of Authors: Lauren Samuel, Rauti Sampsa, Leppänen Ville
Place: New York, USA
Publication year: 2015
Book title *: Proceedings of the 16th International Conference on Computer Systems and Technologies
Title of series: The ACM International Conference Proceedings Series
Number in series: 1008
ISBN: 978-1-4503-3357-3


This paper presents system call diversification as a method for protecting operating systems and rendering malicious programs ineffective. The idea is to change all the system call numbers in the kernel and in the applications that invoke these system calls. As a result, it becomes much more difficult for a harmful program to access resources of a computer since the new system call interface is not known by malware. The diversification of system call numbers is unique for each computer and the space of possible system call remappings is huge. Consecutively, one piece of malware no longer works on several computers and becomes incompatible with their environment. In this paper, we present three different models for system call diversification in Linux kernel. We also provide a detailed discussion on our implementation of one of these models.

Last updated on 2019-14-06 at 12:27