Detecting malicious rootkit web pages in high-interaction client honeypots

Malicious web pages that launch client-side attacks on web browsers have became a severe threat in today´s Internet. High-interaction client honeypots are security devices that detect these malicious web pages on a network. However, high-interaction client honeypots are not good enough for detecting malicious web pages, especially for web pages carrying rootkit which is used to hide the presence of a malicious object (process, file, registry key, network port). To this deficiency, this paper brings forward a detecting technique of kernal integrity which is based on System Services Descriptor Table(SSDT) in High-interaction honeypots client side. The experimental results indicate that the correct ratio in detecting malicious servers raise obviously.