Abstract: In order to prevent the kernel attack within Android system and protect the kernel of Android system, this paper designs a lightweight hypervisor monitoring architecture based on ARM platform. By applying ARM virtualization technology and isolating un-trusted module, this architecture prevents malicious code damage to kernel and the falsification of key objects within the kernel. Moreover, it can detect rootkit with cross view. Experimental results show that this architecture can promptly stop the falsification of monitoring object and quickly detect rootkit and thus reduce the loss of attack on system.

Key words: mobile operating system, kernel, security, virtualization, rootkit detection

摘要： 为阻止针对Android系统内核的攻击，保护Android系统内核不被破坏，设计一种基于ARM平台轻量级的hypervisor监控器架构。该架构利用ARM硬件虚拟化扩展技术，对不信任模块进行隔离，阻止模块中恶意代码对内核的破坏，保护关键对象不被篡改，并基于hypervisor、利用交叉视图检测rootkit。实验结果表明，该架构能及时阻止对被监控对象的修改，快速检测出rootkit威胁，减少系统被攻击后带来的损失。

关键词: 移动操作系统, 内核, 安全, 虚拟化, rootkit检测

CLC Number: 

• TP311