Abstract:

With the wide application of Linux operating systemin the servers and the continuous exposure of kernel vulnerabilities, Linux kernel security has become one of the research focuses in the fields of computer system security. As for the server running Linux system, this paper proposed a system protection model by the way of monitoring kernel functions. It limits the kernel functions that can be accessed by the related daemons and increases the difficulty of malicious attacksso as to enhance the security of Linux kernel.Moreover, some real-time categorical processing is introduced for various abnormal invocations to the kernel functions so that the security level of the entire server system is promoted. Experimental results show that the proposed method can indeed detect the abnormal invocations of the kernel functions timely followed by some appropriate alarming or interception measures. Furthermore, the additional overloads are not too much such that the method is verified to be feasible and effective. Compared with other research work about kernel security, this method can protectbroader kernel coverage and it eliminates the need to recompile and reconstruct the kernel image while kernel monitoring and protection mechanisms are integrated organically.

Key words: security of operating systems, security of kernel, systematic protection, daemon, invocation of kernel functions