Identifying Rootkit Infections Using Data Mining Author Wu, Xin-Wen, Lobo, Desmond, Watters, Paul Published 2010 Conference Title Proceedings of The 2010 International Conference on Information Science and Applications (ICISA) DOI https://doi.org/10.1109/ICISA.2010.5480359 Copyright Statement © 2010 IEEE. Personal use of this material is permitted. However, permission to reprint/ republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. Downloaded from http://hdl.handle.net/10072/37518 Griffith Research Online https://research-repository.griffith.edu.au Identifying Rootkit Infections Using Data Mining Desmond Lobo, Paul Watters and Xin-Wen Wu Internet Commerce Security Laboratory Graduate School of Information Technology and Mathematical Sciences University of Ballarat, Australia
[email protected], {p.watters, x.wu}@ballarat.edu.au Abstract - Rootkits refer to software that is used to hide the Rootkits use various types of hooking techniques in order presence and activity of malware and permit an attacker to take to remain hidden and there are several tools available, such as control of a computer system. In our previous work, we focused McAfee’s Rootkit Detective, that can be used to detect the strictly on identifying rootkits that use inline function hooking hooks that have been created by a rootkit on a computer techniques to remain hidden. In this paper, we extend our system. Each time that such a tool is run, a log file is generated previous work by including rootkits that use other types of that contains a list of the detected hooks.