Advance Kernel Rootkit Detection: Survey

Rootkits are a group of software tools that an attacker uses to break into a system, giving him the ability to access confidential information, hide his own existence, and install additional malicious software. A rootkit cannot be installed without administrative level access for the attacker. Due to their evasiveness, rootkits pose the greatest detection difficulty among malware. Attacks on rootkits today primarily target operating system kernel changes. In this work, a detailed investigation of rootkit detection technology is used to develop a novel typeof rootkit detection structure, a new technique (software), and a structured and comprehensive view of research on rootkit, process hiding, hook, and detection/prevention.