Rootkit is one of the primary concerns of network communication systems, which is related to the security and privacy of Internet users. The worldliness of malicious software (malware) used to breakdown the computer security has increased... more
Rootkit is one of the primary concerns of network communication systems, which is related to the security and privacy of Internet users. The worldliness of malicious software (malware) used to breakdown the computer security has increased exponentially in the recent years. Therefore, early detection of rootkits is on top priority to avoid the unrestrained operation of malware. Most of existing techniques only allow late rootkit detection after the malware has already been hidden by a rootkit. In this paper, we put forward a dynamic framework to detect kernel rootkits and guarantee the runtime security of guest VMs. The method is explicit to a guest Virtual Machine (VM), since it does not require any specific system information. The initial strategy is a virtual machine screen based resource arrangement component, which can limit the resource usage with given execution ensure. The end results reveal that the component that is put forth can allocate resources for a rootkit distinguishing proof on request.
The current online world is constantly affected by malicious software such as viruses, Trojans, worms, spyware and botnets. When such a malicious software integrates with the rootkit technique, it becomes a serious threat to end users.... more
The current online world is constantly affected by malicious software such as viruses, Trojans, worms, spyware and botnets. When such a malicious software integrates with the rootkit technique, it becomes a serious threat to end users. Rootkits themselves do not cause damage to a computer. Instead, they mask their footprints either from antivirus software or anti-rootkit tools to allow a remote attacker to conduct computer crimes for a long time. This property makes malicious code attacks difficult to detect. Traditional techniques that aim to reveal rootkit footprints suffer from false alarm rate and also fail to detect unknown stealthy malicious code attacks. The proposed Concealed Process and Service Discovery Algorithm (CoPDA) introduces a novel cross-view comparison technique that can effectively detect the concealed processes and services of a malicious software in Windows operating system. Compare to existing anti-rootkit detection tools, the experimental results show that CoPDA can be effectively used to discover hidden process and service and deserved 99.02% detection accuracy, 100% true positive rate and 1.82% false positive rate. Additionally, CoPDA is portable across various operating systems with only negligible tweaking.
Rootkit is an auxiliary tool for sniffing, stealing and hiding, so it has become the key component in almost all successful attacks. Analysis of rootkits will provide system administrators and security software managers the ability to... more
Rootkit is an auxiliary tool for sniffing, stealing and hiding, so it has become the key component in almost all successful attacks. Analysis of rootkits will provide system administrators and security software managers the ability to detect and prevent a computer being compromised. Ontology will provide detailed conceptualization to represent the rootkit concepts and its relationships to other security concepts in cyber-attack domain. In this paper we presented an ontology for rootkits which contains many concepts relating to security, cyber-attacks and operating systems. We divided rootkits according to four attributes, and expanded the ontology for rootkits accordingly. This ontology can be used to distinguish different types of rootkits
