Detecting Kernel Rootkits in a Virtualized Infrastructure with Low-Level Architectural Features

Zhou, Huaizhe; Fei, Changjiang; Ni, Lin; Wu, Bo; Han, Kun

doi:10.1109/icece56287.2022.10048623

2022 IEEE 5th International Conference on Electronics and Communication Engineering (ICECE) 2022

DOI: 10.1109/icece56287.2022.10048623

|View full text |Cite

Detecting Kernel Rootkits in a Virtualized Infrastructure with Low-Level Architectural Features

Huaizhe Zhou

Changjiang Fei

Lin Ni

et al.

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2023

Publication Types

Select...

Article1

Relationship

Self Cite0

Independent1

Authors

Journals

Cited by 1 publication

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Volatile Kernel Rootkit hidden process detection in cloud computing

2023

J Cloud Comp

View full text Add to dashboard Cite

The rootkit industry has advanced significantly in the last decade. Attackers want to leave a backdoor for quick reoccurring exploits rather than launching the traditional one-time worm/virus attacks. Meanwhile, as intrusion detection technologies improve, rootkits have grown in popularity. For the attackers to succeed, stealth becomes critical. The primary function of rootkits is to provide stealth. The modifications a rootkit makes conceal the presence of a rootkit. Determining the presence of mutation rootkits was quite challenging. Attackers can silently alter volatile (processes) and non-volatile (files) with the aid of rootkits without being noticed. We suggested the VKRHPDV (Volatile Kernel Rootkit Hidden Process Detection) framework to find the hidden techniques. This system includes process monitors, process comparison analysts, and contaminated process data gathering. Process monitoring is nothing more than clean process collection in the absence of rootkits, whereas pure process collection has been corrupted by rootkit injection. The process analyzer compares clean and tainted processes, some of which were concealed. VKRHPDV can identify process hiding behaviors in all datasets in the shortest period, according to the findings of an extensive performance analysis carried out on 64 rootkit datasets for each UNIX and Windows kernel in a cloud environment.

show abstract

Volatile Kernel Rootkit hidden process detection in cloud computing

2023

J Cloud Comp

View full text Add to dashboard Cite

show abstract

scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.

Contact Info

hi@scite.ai

10624 S. Eastern Ave., Ste. A-614

Henderson, NV 89052, USA

Blog Terms and Conditions API Terms Privacy Policy Contact Cookie Preferences Do Not Sell or Share My Personal Information

Made with 💙 for researchers

Part of the Research Solutions Family.

Detecting Kernel Rootkits in a Virtualized Infrastructure with Low-Level Architectural Features

Cited by 1 publication

References 8 publications

Volatile Kernel Rootkit hidden process detection in cloud computing

Volatile Kernel Rootkit hidden process detection in cloud computing

Contact Info

Product

Resources

About