Back to articles
Articles
Volume: 33 | Article ID: art00003
Image
Characteristic Features of the Kernel-level Rootkit for Learning-based Detection Model Training
  DOI :  10.2352/ISSN.2470-1173.2021.3.MOBMU-034  Published OnlineJune 2021
Abstract

The core part of the operating system is the kernel, and it plays an important role in managing critical data structure resources for correct operations. The kernel-level rootkits are the most elusive type of malware that can modify the running OS kernel in order to hide its presence and perform many malicious activities such as process hiding, module hiding, network communication hiding, and many more. In the past years, many approaches have been proposed to detect kernel-level rootkit. Still, it is challenging to detect new attacks and properly categorize the kernel-level rootkits. Memory forensic approaches showed efficient results with the limitation against transient attacks. Cross-view-based and integrity monitoring-based approaches have their own weaknesses. A learning-based detection approach is an excellent way to solve these problems. In this paper, we give an insight into the kernel-level rootkit characteristic features and how the features can be represented to train learning-based models in order to detect known and unknown attacks. Our feature set combined the memory forensic, cross-view, and integrity features to train learning-based detection models. We also suggest useful tools that can be used to collect the characteristics features of the kernel-level rootkit.

Subject Areas :
Views 37
Downloads 6
 articleview.views 37
 articleview.downloads 6
  Cite this article 

Mohammad Nadim, Wonjun Lee, David Akopian, "Characteristic Features of the Kernel-level Rootkit for Learning-based Detection Model Trainingin Proc. IS&T Int’l. Symp. on Electronic Imaging: Mobile Devices and Multimedia: Technologies, Algorithms & Applications,  2021,  pp 34-1 - 34-6,  https://doi.org/10.2352/ISSN.2470-1173.2021.3.MOBMU-034

 Copy citation
  Copyright statement 
Copyright © Society for Imaging Science and Technology 2021
72010604
Electronic Imaging
2470-1173
Society for Imaging Science and Technology
IS&T 7003 Kilworth Lane • Springfield, VA 22151 USA