{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,21]],"date-time":"2026-07-21T06:31:29Z","timestamp":1784615489567,"version":"3.55.0"},"reference-count":47,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2020,6,25]],"date-time":"2020-06-25T00:00:00Z","timestamp":1593043200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2020,6,25]],"date-time":"2020-06-25T00:00:00Z","timestamp":1593043200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2021,8]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Cyberattacks, especially attacks that exploit operating system vulnerabilities, have been increasing in recent years. In particular, if administrator privileges are acquired by an attacker through a privilege escalation attack, the attacker can operate the entire system and cause serious damage. In this paper, we propose an additional kernel observer (AKO) that prevents privilege escalation attacks that exploit operating system vulnerabilities. We focus on the fact that a process privilege can be changed only by specific system calls. AKO monitors privilege information changes during system call processing. If AKO detects a privilege change after system call processing, whereby the invoked system call does not originally change the process privilege, AKO regards the change as a privilege escalation attack and applies countermeasures against it. AKO can therefore prevent privilege escalation attacks. Introducing the proposed method in advance can prevent this type of attack by changing any process privilege that was not originally changed in a system call, regardless of the vulnerability type. In this paper, we describe the design and implementation of AKO for Linux x86 64-bit. Moreover, we show that AKO can be expanded to prevent the falsification of various data in the kernel space. Then, we present an expansion example that prevents the invalidation of Security-Enhanced Linux. Finally, our evaluation results show that AKO is effective against privilege escalation attacks, while maintaining low overhead.\n<\/jats:p>","DOI":"10.1007\/s10207-020-00514-7","type":"journal-article","created":{"date-parts":[[2020,6,25]],"date-time":"2020-06-25T05:02:17Z","timestamp":1593061337000},"page":"461-473","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":17,"title":["Additional kernel observer: privilege escalation attack prevention mechanism focusing on system call privilege changes"],"prefix":"10.1007","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6226-5715","authenticated-orcid":false,"given":"Toshihiro","family":"Yamauchi","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yohei","family":"Akao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ryota","family":"Yoshitani","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuichi","family":"Nakamura","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Masaki","family":"Hashimoto","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2020,6,25]]},"reference":[{"key":"514_CR1","unstructured":"Kemerlis, V. P., Portokalidis, G. and Keromytis, A.D.: kGuard: lightweight kernel protection against return-to-user attacks. In: Proceedings of USENIX Security \u201912, pp. 459\u2013474 (2012)"},{"key":"514_CR2","unstructured":"Kemerlis, V.P., Polychronakis, M., Keromytis, A.D.: ret2dir: rethinking Kernel isolation. In: Proceedings of USENIX Security \u201914, pp. 957\u2013972 (2014)"},{"key":"514_CR3","unstructured":"Linux Counter. https:\/\/www.linuxcounter.net\/statistics\/kernel"},{"key":"514_CR4","doi-asserted-by":"crossref","unstructured":"Niu, S., Mo, J., Zhang, Z., et al.: Overview of linux vulnerabilities. In: Proceedings of SCICT 2014, pp. 225\u2013228 (2014)","DOI":"10.2991\/scict-14.2014.55"},{"key":"514_CR5","doi-asserted-by":"crossref","unstructured":"Chen, H., Mao, Y., Wang, X., et al.: Linux kernel vulnerabilities: state-of-the-art defenses and open problems. In: Proceedings of APSys \u201911, No. 5 (2011)","DOI":"10.1145\/2103799.2103805"},{"key":"514_CR6","doi-asserted-by":"crossref","unstructured":"Abadi, M., Budiu, M., Erlingsson, U., et al.: Control-flow integrity. In: Proceedings of CCS \u201905, pp. 340\u2013353 (2005)","DOI":"10.1145\/1102120.1102165"},{"key":"514_CR7","doi-asserted-by":"crossref","unstructured":"Petroni, Jr., N.L., Hicks, M.: Automated detection of persistent kernel control-flow attacks. In: Proceedings of CCS \u201907, pp. 103\u2013115 (2007)","DOI":"10.1145\/1315245.1315260"},{"key":"514_CR8","doi-asserted-by":"crossref","unstructured":"Criswell, J., Dautenhahn, N., Adve, V.: KCoFI: complete control-flow integrity for commodity operating system kernels. In: Proceedings of IEEE S&P \u201914, pp. 292\u2013307 (2014)","DOI":"10.1109\/SP.2014.26"},{"key":"514_CR9","unstructured":"Chen, S., Xu, J., Sezer, E.C., et al.: Non-control-data attacks are realistic threats. In: Proceedings of USENIX Security \u201905, pp. 177\u2013192 (2005)"},{"key":"514_CR10","unstructured":"Trusted Computing Group: Trusted Boot. http:\/\/www.trustedcomputinggroup.org\/trusted-boot\/"},{"key":"514_CR11","unstructured":"Integrity Measurement Architecture (IMA). https:\/\/sourceforge.net\/projects\/linux-ima\/"},{"key":"514_CR12","unstructured":"Loscocco, P., Smalley, S.: Integrating flexible support for security policies into the linux operating system. In: Proceedings of the FREENIX Track: USENIX ATC 2001, pp. 29\u201342 (2001)"},{"key":"514_CR13","unstructured":"NSA\/CSS: Security-Enhanced Linux. https:\/\/www.nsa.gov\/what-we-do\/research\/selinux\/"},{"key":"514_CR14","unstructured":"TOMOYO Linux. https:\/\/tomoyo.osdn.jp\/index.html"},{"key":"514_CR15","unstructured":"Cowan, C., Beattie, S., Kroah-Hartman, G., et al.: SubDomain: parsimonious server security. In: Proceedings of LISA \u201900, pp. 355\u2013368 (2000)"},{"key":"514_CR16","unstructured":"AppArmor security project wiki. http:\/\/wiki.apparmor.net\/index.php\/Main_Page"},{"key":"514_CR17","unstructured":"Smalley, S., Craig, R.: Security enhanced (SE) Android: bringing flexible MAC to Android. In: NDSS 2013 (2013)"},{"key":"514_CR18","unstructured":"Security Enhancements (SE) for Android. http:\/\/seandroid.bitbucket.org\/"},{"key":"514_CR19","doi-asserted-by":"crossref","unstructured":"Szekeres, L., Payer, M., Wei, T., et al.: SoK: eternal war in memory. In: Proceedings of IEEE S&P \u201913, pp. 48\u201362 (2013)","DOI":"10.1109\/SP.2013.13"},{"key":"514_CR20","unstructured":"JVN iPedia. https:\/\/jvndb.jvn.jp\/en\/"},{"key":"514_CR21","unstructured":"Exploit Database, Linux Kernel 3.4 $$<$$ 3.13.2 (Ubuntu 13.04\/13.10) - \u2019CONFIG\\_X86\\_X32=y\u2019 Local Root Exploit (3). https:\/\/www.exploit-db.com\/exploits\/31347\/"},{"key":"514_CR22","unstructured":"Exploiting the Futex Bug and uncovering Towelroot. http:\/\/tinyhack.com\/2014\/07\/07\/exploiting-the-futex-bug-and-uncovering-towelroot\/"},{"key":"514_CR23","unstructured":"Hallyn, S.E., Morgan A.G.: Linux capabilities: making them work. In: Proceedings of Linux Symposium, pp. 163\u2013172 (2008)"},{"key":"514_CR24","unstructured":"Exploit Database, Nexus 5 Android 5.0\u2014Privilege Escalation. https:\/\/www.exploit-db.com\/exploits\/35711\/"},{"key":"514_CR25","unstructured":"grsecurity: super fun 2.6.30+\/RHEL5 2.6.18 local kernel exploit. https:\/\/grsecurity.net\/~spender\/exploits\/exploit2.txt"},{"key":"514_CR26","unstructured":"Wright, C., Cowan, C., Smalley, S., et al.: Linux security modules: general security support for the linux kernel. In: Proceedings of USENIX Security \u201902, pp. 17\u201331 (2002)"},{"key":"514_CR27","unstructured":"Exploit Database, Linux Kernel 3.7.10 (Ubuntu 12.10 x64) - \u2019sock\\_diag\\_handlers\u2019 Local Root Exploit (2). https:\/\/www.exploit-db.com\/exploits\/24746\/"},{"key":"514_CR28","unstructured":"Exploit Database, Linux Kernel 3.14.5 (RHEL \/ CentOS 7) - \u2019libfutex\u2019 Local Root Exploit, https:\/\/www.exploit-db.com\/exploits\/35370\/"},{"key":"514_CR29","unstructured":"Exploit Database, Linux Kernel 4.4.1\u2014REFCOUNT Overflow\/Use-After-Free in Keyrings Privilege Escalation (1)C https:\/\/www.exploit-db.com\/exploits\/39277\/"},{"key":"514_CR30","unstructured":"kernel-exploits\/poc.c. https:\/\/github.com\/xairy\/kernel-exploits\/blob\/master\/CVE-2017-6074\/poc.c"},{"key":"514_CR31","unstructured":"LMbench\u2014Tools for Performance Analysis. http:\/\/www.bitmover.com\/lmbench\/"},{"issue":"9","key":"514_CR32","first-page":"2047","volume":"55","author":"Y Ikegami","year":"2014","unstructured":"Ikegami, Y., Yamauchi, T.: Proposal of kernel rootkits detection method by comparing kernel stack. IPSJ J. 55(9), 2047\u20132060 (2014). (in Japanese)","journal-title":"IPSJ J."},{"issue":"10","key":"514_CR33","doi-asserted-by":"publisher","first-page":"2377","DOI":"10.1587\/transinf.2016INL0003","volume":"E100\u2013D","author":"T Yamauchi","year":"2017","unstructured":"Yamauchi, T., Akao, Y.: Kernel rootkits detection method by monitoring branches using hardware features. IEICE Trans. Inf. Syst. E100\u2013D(10), 2377\u20132381 (2017)","journal-title":"IEICE Trans. Inf. Syst."},{"key":"514_CR34","unstructured":"Intel, Intel 64 and IA-32 Architectures Software Developer\u2019s Manual Volume 3B"},{"key":"514_CR35","unstructured":"DIRTY COW. https:\/\/dirtycow.ninja\/"},{"key":"514_CR36","unstructured":"Tripwire Inc.: Tripwire. https:\/\/www.tripwire.org\/"},{"key":"514_CR37","unstructured":"Provos, N., Friedl, M., Honeyman, P.: Preventing privilege escalation. In: Proceedings of USENIX Security \u201903 (2003)"},{"key":"514_CR38","doi-asserted-by":"crossref","unstructured":"Chen, Q., Azab, A. M., Ganesh, G., et al.: PrivWatcher: non-bypassable monitoring and protection of process credentials from memory corruption attacks. In: Proceedings of ASIA CCS \u201917, pp. 167\u2013178 (2017)","DOI":"10.1145\/3052973.3053029"},{"key":"514_CR39","unstructured":"Li, Y., Dolan-Gavitt, B., Weber, S., et al.: Lock-in-pop: securing privileged operating system kernels by keeping on the beaten path. In: Proceedings of USENIX ATC \u201917, pp. 1\u201313 (2017)"},{"key":"514_CR40","unstructured":"Carlini, N., Barresi, A., Payer, M., et al.: Control-flow bending: on the effectiveness of control-flow integrity. In: Proceedings of USENIX Security \u201915, pp. 161\u2013176 (2015)"},{"key":"514_CR41","doi-asserted-by":"crossref","unstructured":"Evans, J., Long, F., Otgonbaatar, U., et al.: Control Jujutsu: on the weaknesses of fine-grained control flow integrity. In: Proceedings of CCS \u201915, pp. 901\u2013913 (2015)","DOI":"10.1145\/2810103.2813646"},{"key":"514_CR42","unstructured":"Intel 64 and IA-32 Architectures Software Developer\u2019s Manual Volume 3A: System Programming Guide, Part 1, http:\/\/www.intel.com\/content\/dam\/www\/public\/us\/en\/documents\/manuals\/64-ia-32-architectures-software-developer-vol-3a-part-1-manual.pdf"},{"key":"514_CR43","unstructured":"ARM Cortex-A Series Programmer\u2019s Guide for ARMv8-A. http:\/\/infocenter.arm.com\/help\/topic\/com.arm.doc.den0024a\/DEN0024A_v8_architecture_PG.pdf"},{"key":"514_CR44","unstructured":"Looking at the local Linux kernel privilege escalation. http:\/\/blog.siphos.be\/2013\/05\/looking-at-the-local-linux-kernel-privilege-escalation\/"},{"key":"514_CR45","doi-asserted-by":"crossref","unstructured":"Azab, A. M., Ning, P., Shah, J., et al.: Hypervision across worlds: real-time kernel protection from the ARM TrustZone secure world. In: Proceedings of CCS \u201914, pp. 90\u2013102 (2014)","DOI":"10.1145\/2660267.2660350"},{"key":"514_CR46","doi-asserted-by":"crossref","unstructured":"Riley, R., Jiang, X., Xu, D.: Guest-transparent prevention of kernel rootkits with VMM-based memory shadowing. In: Proceedings of RAID \u201908, pp. 1\u201320 (2008)","DOI":"10.1007\/978-3-540-87403-4_1"},{"key":"514_CR47","doi-asserted-by":"crossref","unstructured":"Seshadri, A., Juk, M., Qu, N., et al.: SecVisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity OSes. In: Proceedings of SOSP \u201907, pp. 335\u2013350 (2007)","DOI":"10.1145\/1294261.1294294"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-020-00514-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-020-00514-7\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-020-00514-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,7,27]],"date-time":"2021-07-27T09:10:04Z","timestamp":1627377004000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-020-00514-7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,6,25]]},"references-count":47,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2021,8]]}},"alternative-id":["514"],"URL":"https:\/\/doi.org\/10.1007\/s10207-020-00514-7","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,6,25]]},"assertion":[{"value":"25 June 2020","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Compliance with ethical standards"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}