一种新的内核级Rootkit的检测方法

New method of detecting kernel-level Rootkit

对Rootkit的基本概念进行了介绍,然后延伸至内核级Rootkit。在详细剖析内核级Rootkit原理的基础上分析了其他检测Rootkit方法的局限性,提出一种新的方法。该方法分析内核模块加载时是否有可疑行为,结合对比system.map和kmem文件判断其是否为Rootkit。最后用实验证明了此方法的有效性。

This paper introduced the basic concept of Rootkit, and then extended to kernel-level Rootkit. On the basis of analyzing the principle of kernel level Rootkits and the limitations of others Rootkit detection, proposed a new method. This method analyzed if there was suspicious behavior at loading kernel module, compared with system, map and kmem to determine whether it was Rootkit or not. At last, proved the effectiveness of this method through an experiment.