Kernel Rootkit Detection Method Based on Multidimensional View Tracking

In Linux servers, kernel Rootkit can be concealed in the operating system for a long time, causing serious kernel damage. In particular, unknown Rootkit, with random attack occurrence time and spatial distribution, pose a significant challenge to discovering the source of an attack. Because the source code is unknown, conventional methods face difficulties in analyzing its behavioral characteristics and are unable to pre-set detection points at appropriate locations. To address this threat, this study proposes a kernel Rootkit detection method based on multidimensional view tracing. By cross-comparing multiple views in both the spatial and temporal dimensions, the malicious behavior of unknown kernel Rootkit is detected and hidden data are restored. Experiments and analyses show that the proposed method is efficient in detecting kernel Rootkit, with a CPU overhead of only 0.38% in the case of a secure response cycle of 0.1 s.