Kernel level Rootkit detection method and system

Abstract

The invention discloses a kernel level Rootkit detection method. The kernel level Rootkit detection method includes: analyzing a System.map symbol table, and acquiring a static symbol name and a symbol type; analyzing a kallsyms symbol table, and acquiring a dynamic symbol name, a symbol type and a module to which the symbol belongs; and comparing the kallsyms symbol table and the System.map symbol table, and determining if a Rootkit behavior exists in a system or not. At present, the method for solving an unknown Rootkit can perform detection through kernel dynamic monitoring or virtual machine execution analysis technology, is complex in detection means, needs writing a kernel module, can only be used for kernel versions in a certain range, has no universality, and is poor in cross-platform universality. The method for comparing kernel symbol tables can achieve determination and detection of the Rootkit on an application layer, is not limited by the kernel versions, and has the simplicity and the universality.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a kernel-level Rootkit detection method and system. Background technique [0002] With the rapid development of computer networks, information security has increasingly become one of the major issues in today's society. There is no absolute security, and attack and defense will always be the constant theme in the field of information security. Being able to deeply understand and study various attack behaviors has a good reference value for better implementation of information security. As an open source operating system, Linux has always been considered to be more secure than Windows. However, as distributions become more popular and users are increasing, the security problems of Linux are also particularly prominent. However, rootkits are used to attack Linux systems. A powerful tool that has penetrated into the PC more deeply, has strong concealment, and problems that...

AI Technical Summary

Problems solved by technology

The signature-based detection method is the simplest, but this detection method cannot detect unknown rootkits and is not universally applicable. Other detection methods mostly use kernel programming, behavior analysis or virtual execution to detect whether there is an injection module. Then detect whether there is a Rootkit, this method has high complexity, and most of them depend on the limitation of the kernel version, and the cross-platform performance is poor. For the detector who does not have the kernel module programming ability, it is difficult to implement, and sometimes it may be wasted A lot of time but can't detect

Images