Proactive Detection of Kernel-Mode Rootkits

The sophistication of malicious software (malware) used to break the computer security has increased exponentially in the last years. Frequently, malware is hidden into a computer by software components called root kits. Therefore, early detection of root kits is of primary importance to avoid the uncontrolled operation of malware. Most of current techniques for root kit detection only allow a late detection after the malware has already been hidden by a root kit. In this paper, a new technique is presented that enables the proactive detection of root kits while they are hiding malware, and therefore, allowing that hiding can be avoided. The technique has been designed for root kits that operate in kernel-mode. This root kits are particularly difficult to detect because both the detector and the root kit are executed with the same privileges. This technique can be used to improve the detection capabilities of intrusion detection and prevention systems.