- Title
- Identifying rootkit infections using data mining
- Creator
- Lobo, Desmond; Watters, Paul; Wu, Xinwen
- Date
- 2010
- Type
- Text; Conference paper
- Identifier
- http://researchonline.federation.edu.au/vital/access/HandleResolver/1959.17/44113
- Identifier
- vital:3454
- Identifier
-
https://doi.org/10.1109/ICISA.2010.5480359
- Identifier
- ISBN:9781424459438
- Abstract
- Rootkits refer to software that is used to hide the presence and activity of malware and permit an attacker to take control of a computer system. In our previous work, we focused strictly on identifying rootkits that use inline function hooking techniques to remain hidden. In this paper, we extend our previous work by including rootkits that use other types of hooking techniques, such as those that hook the IATs (Import Address Tables) and SSDTs (System Service Descriptor Tables). Unlike other malware identification techniques, our approach involved conducting dynamic analyses of various rootkits and then determining the family of each rootkit based on the hooks that had been created on the system. We demonstrated the effectiveness of this approach by first using the CLOPE (Clustering with sLOPE) algorithm to cluster a sample of rootkits into several families; next, the ID3 (Iterative Dichotomiser 3) algorithm was utilized to generate a decision tree for identifying the rootkit that had infected a machine. ©2010 IEEE.
- Publisher
- Seoul, Korea : IEEE
- Relation
- Paper presented at 2010 International Conference on Information Science and Applications, ICISA 2010, Seoul, Korea : p. 1-7
- Rights
- Copyright IEEE
- Rights
- Open Access
- Rights
- This metadata is freely available under a CCO license
- Subject
- Computer security; Data mining; Rootkits
- Full Text
- Hits: 1323
- Visitors: 1494
- Downloads: 234
| Thumbnail | File | Description | Size | Format | |||
|---|---|---|---|---|---|---|---|
| View Details Download | SOURCE1 | Published version | 128 KB | Adobe Acrobat PDF | View Details Download |