A Methodology to Detect Kernel Level Rootkits based on Detecting Hidden Processes

Abstract

Intruders will normally install some tools when he gains access to a computer system, in order to regain the root privilege when he come back onto the system at a later time. Installing a rookit on the compromised system is one of the methods that a intruder may use. The kernel of the operating system which is the lowest level of most modern OS will be modified by a kernel level rootkit. In this paper we present a standardized methodology to detect rootkits. Through this method, it is possible to provide additional protection against this type of malicious modification of the kernel.