Multi-Aspect Profiling of Kernel Rootkit Behavior
Source: Association for Computing Machinery
Kernel rootkits, malicious software designed to compromise a running operating system kernel, are difficult to analyze and profile due to their elusive nature, the variety and complexity of their behavior, and the privilege level at which they run. However, a comprehensive kernel rootkit profile that reveals key aspects of the rootkit's behavior is helpful in aiding a detailed manual analysis by a human expert. In this paper the authors present PoKeR, a kernel rootkit profiler capable of producing multi-aspect rootkit profiles which include the revelation of rootkit hooking behavior, the exposure of targeted kernel objects (Both static and dynamic), assessment of user-level impacts, as well as the extraction of kernel rootkit code.
| Format: | Size: | 178.30 | |
| Date: | Apr 2009 |
People who downloaded this item also downloaded
- Automatic Analysis of Malware Behavior Using Machine Learning
- Countering Persistent Kernel Rootkits Through Systematic Hook Discovery
- A View on Current Malware Behaviors
- Learning and Classification of Malware Behavior
