Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: Co-processor-based Behavior Monitoring: Application to the Detection of
  Attacks Against the System Management Mode   Highly privileged software, such as firmware, is an attractive target for
attackers. Thus, BIOS vendors use cryptographic signatures to ensure firmware
integrity at boot time. Nevertheless, such protection does not prevent an
attacker from exploiting vulnerabilities at runtime. To detect such attacks, we
propose an event-based behavior monitoring approach that relies on an isolated
co-processor. We instrument the code executed on the main CPU to send
information about its behavior to the monitor. This information helps to
resolve the semantic gap issue. Our approach does not depend on a specific
model of the behavior nor on a specific target. We apply this approach to
detect attacks targeting the System Management Mode (SMM), a highly privileged
x86 execution mode executing firmware code at runtime. We model the behavior of
SMM using invariants of its control-flow and relevant CPU registers (CR3 and
SMBASE). We instrument two open-source firmware implementations: EDK II and
coreboot. We evaluate the ability of our approach to detect state-of-the-art
attacks and its runtime execution overhead by simulating an x86 system coupled
with an ARM Cortex A5 co-processor. The results show that our solution detects
intrusions from the state of the art, without any false positives, while
remaining acceptable in terms of performance overhead in the context of the SMM
(i.e., less than the 150 $\mu$s threshold defined by Intel).

0
The categories of this paper are: hep-ph
34
The categories of this paper are: chem-ph
9
The categories of this paper are: nlin
30
The categories of this paper are: q-alg
23
The categories of this paper are: solv-int
36
The categories of this paper are: cmp-lg
28
The categories of this paper are: alg-geom
15
The categories of this paper are: nucl-ex
13
The categories of this paper are: quant-ph
24
The categories of this paper are: dg-ga
27
The categories of this paper are: comp-gas
22
The categories of this paper are: chao-dyn
5
The categories of this paper are: gr-qc
8
The categories of this paper are: hep-ex
10
The categories of this paper are: q-bio
2
The categories of this paper are: math