2019/04/29 by John Pendergrass, J. Aaron Pendergrass, Pendergrass, J. Aaron +15
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #FOS: Computer and information sciences #Security and Verification in Computing #cs.CR
paper · pdf · doi:10.48550/arxiv.1904.12896
arxiv created 2019/04/29 · openalex publication_date 2019/04/29 · arxiv updated 2019/05/01 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
This paper presents the Userspace Integrity Measurement Toolkit (USIM Toolkit), a set of integrity measurement collection tools capable of detecting advanced malware threats, such as memory-only implants, that evade many traditional detection tools. Userspace integrity measurement validates that a platform is free from subversion by validating that the current state of the platform is consistent with a set of invariants. The invariants enforced by the USIM Toolkit are carefully chosen based on the expected behavior of userspace, and key behaviors of advanced malware. Userspace integrity measurement may be combined with existing filesystem and kernel integrity measurement approaches to provide stronger guarantees that a platform is executing the expected software and that the software is in an expected state.