Diversification of System Calls in Linux Kernel




Lauren Samuel, Rauti Sampsa, Leppänen Ville

Boris Rachev, Angel Smrikarov

International Conference on Computer Systems and Technologies

New York, USA

2015

Proceedings of the 16th International Conference on Computer Systems and Technologies

The ACM International Conference Proceedings Series

1008

284

291

978-1-4503-3357-3

DOIhttps://doi.org/10.1145/2812428.2812447(external)



This paper presents system call diversification as a method for protecting operating systems and rendering malicious programs ineffective. The idea is to change all the system call numbers in the kernel and in the applications that invoke these system calls. As a result, it becomes much more difficult for a harmful program to access resources of a computer since the new system call interface is not known by malware. The diversification of system call numbers is unique for each computer and the space of possible system call remappings is huge. Consecutively, one piece of malware no longer works on several computers and becomes incompatible with their environment. In this paper, we present three different models for system call diversification in Linux kernel. We also provide a detailed discussion on our implementation of one of these models.




Last updated on 2024-26-11 at 16:45