Enforcing Mandatory Access Control in Commodity OS to Disable Malware

Enforcing a practical Mandatory Access Control (MAC) in a commercial operating system to tackle malware problem is a grand challenge but also a promising approach. The firmest barriers to apply MAC to defeat malware programs are the incompatible and unusable problems in existing MAC systems. To addr...

Full description

Saved in:
Bibliographic Details
Published inIEEE transactions on dependable and secure computing Vol. 9; no. 4; pp. 541 - 555
Main Authors Shan, Zhiyong, Wang, Xin, Chiueh, Tzi-cker
Format Journal Article
LanguageEnglish
Published Washington IEEE 01.07.2012
IEEE Computer Society
Subjects
Access control
Access controls
Computer information security
Computer viruses
Design engineering
Intrusion
Intrusion detection systems
invasive software
Malware
operating system
Operating systems
OS-level information flow
Protocols
Prototypes
Prototyping
Studies
Tracers
Usability
Online AccessGet full text

Cover

More Information
Summary:Enforcing a practical Mandatory Access Control (MAC) in a commercial operating system to tackle malware problem is a grand challenge but also a promising approach. The firmest barriers to apply MAC to defeat malware programs are the incompatible and unusable problems in existing MAC systems. To address these issues, we manually analyze 2,600 malware samples one by one and two types of MAC enforced operating systems, and then design a novel MAC enforcement approach, named Tracer, which incorporates intrusion detection and tracing in a commercial operating system. The approach conceptually consists of three actions: detecting, tracing, and restricting suspected intruders. One novelty is that it leverages light-weight intrusion detection and tracing techniques to automate security label configuration that is widely acknowledged as a tough issue when applying a MAC system in practice. The other is that, rather than restricting information flow as a traditional MAC does, it traces intruders and restricts only their critical malware behaviors, where intruders represent processes and executables that are potential agents of a remote attacker. Our prototyping and experiments on Windows show that Tracer can effectively defeat all malware samples tested via blocking malware behaviors while not causing a significant compatibility problem.
Bibliography:ObjectType-Article-2
SourceType-Scholarly Journals-1
ObjectType-Feature-1
content type line 23
ISSN:1545-5971
1941-0018
DOI:10.1109/TDSC.2012.36