This paper presents system call diversification as a method for protecting operating systems and rendering malicious programs ineffective. The idea is to change all the system call numbers in the kernel and in the applications that invoke these system calls. As a result, it becomes much more difficult for a harmful program to access resources of a computer since the new system call interface is not known by malware. The diversification of system call numbers is unique for each computer and the space of possible system call remappings is huge. Consecutively, one piece of malware no longer works on several computers and becomes incompatible with their environment. In this paper, we present three different models for system call diversification in Linux kernel. We also provide a detailed discussion on our implementation of one of these models.

Presented at CompSysTech ’15. The 16th International Conference on Computer Systems and Technologies

Samuel Laurén, Sampsa Rauti,  Ville Leppänen (University of Turku): Diversification of system calls in linux kernel

http://dl.acm.org/citation.cfm?id=2812447