BOOTKIT Detection Based on UEFI

UEFI-based BOOTKIT compromise the integrity of both UEFI firmware and OS, posing a fatal threat on the security of computer. In response, a new bootkit defense system based on UEFI, named UDS, is proposed in this paper. The proposed UDS is implemented as a UEFI device driver, which is booted before the OS. By adopting a strategy that combines integrity checking and file restoring, UDS protects firmware and OS kernels. And the methods of code obfuscation and file hiding are introduced to prevent UDS itself from being attacked by BOOTKIT. Finally, several experiments had been conducted to prove that UDS can protect itself from the attack of BOOTKIT, while effectively protecting integrity of both OS and firmware.