Copilot - a Coprocessor-based Kernel Runtime Integrity Monitor

By Nick L. Petroni Jr., Timothy Fraser, J. Molina, William A. Arbaugh. USENIX Security Symposium, 2004

553 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/2076ea658f23f76715f0f770b40ffb83969109bd

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing (2008, methodology): “Petroni et al. [4] and Zhang et al. [34] propose the use of external hardware to grab the runtime OS memory image and detect possible rootkit presence by spotting certain kernel code integrity violations (e.g., rootkit-inﬂicted kernel code manipulation).”
Lares: An Architecture for Secure Active Monitoring Using Virtualization (2008, methodology): “first proposed CoPilot, a coprocessor based kernel integrity monitor that runs in a PCI card [23] and monitors kernel memory using DMA.”
SMM rootkits: a new breed of OS independent malware (2008, background): “It has also been suggested to move detection off the CPU onto another hardware device that has access to physical memory [14].”
Security and privacy challenges in industrial Internet of Things (2015, background): “Since malicious software on the prover’s platform could forge this report, its authenticity is typically assured by secure hardware [49, 67, 48, 14, 29, 56, 26] and/or trusted software [3, 24, 60, 59, 58, 57, 16, 32, 29, 68].”
Pioneer: verifying code integrity and enforcing untampered code execution on legacy systems (2005, methodology): “Copilot -a coprocessor-based kernel runtime integrity monitor.”
Automated detection of persistent kernel control-flow attacks (2007, methodology): “To detect this attack, some systems regularly compare the contents of the system call table to a previously observed state [14, 23]; any difference suggests an attack.”
Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction (2007, methodology): “Copilot [51] detects possible kernel integrity violations by running the monitoring software on a separate PCI card.”
Secure and Flexible Monitoring of Virtual Machines (2007, methodology): “Petroni et al developed Copilot [23], a secure coprocessor used to monitor the memory of a host.”
SecVisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity OSes (2007, result): “We mention a generic version of the same attack against Copilot [17] in our earlier work [20].”