The Evolution of Process Hiding Techniques in Malware - Current Threats and Possible Countermeasures
By Sebastian Eresheim, Robert Luh, Sebastian Schrittwieser. 2017
18 citations recorded by the source corpus.
: Rootkits constitute a significant threat to modern computing and information systems. Since their first appearance in the early 1990’s they have steadily evolved, adapting to ever-improving security measures. The main feature rootkits have in common is the ability to hide their malicious presence and activities from the operating system and its legitimate users. In this paper we systematically analyze process hiding techniques routinely used by rootkit malware. We summarize the characteristics of di ff erent approaches and discuss their advantages and limitations. Furthermore, we assess detection and prevention techniques introduced in operating systems in response to the threat of hidden malware. The results of our assessments show that defenders still struggle to keep up with rootkit authors. At the same time we see a shift towards powerful VM-based techniques that will continue to evolve over the coming years.
Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Fabio Pierazzi
- Lorenzo Cavallaro
- Walter J. Scheirer
- Jacopo Cortellazzi
- Feargus Pendlebury
- Jacob Dumford
- Terrance E. Boult
- B. Liu
In Computer Networks and Communications
In Signal Processing
- Fabio Pierazzi
- Lorenzo Cavallaro
- Walter J. Scheirer
- Jacopo Cortellazzi
- Feargus Pendlebury
- Jacob Dumford
Citations in the corpus
- Backdooring Convolutional Neural Networks via Targeted Weight Perturbations (2018, methodology): “The following are basic rootkit or process hiding techniques that have been implemented [6].”
- Intriguing Properties of Adversarial ML Attacks in the Problem Space (2019, background): “separate segment of the binary and, as IAT patching is a known malicious strategy used by malware authors [25], IAT calls to non-standard dynamic linkers or multiple jumps from the IAT to an internal segment of the binary would immediately be identified as suspicious.”