Affiliation:
1. School of Electrical Engineering and Computer Science, National University of Sciences and Technology, Islamabad 44000, Pakistan
Abstract
Rootkits are malicious programs designed to conceal their activities on compromised systems, making them challenging to detect using conventional methods. As the threat landscape continually evolves, rootkits pose a serious threat by stealthily concealing malicious activities, making their early detection crucial to prevent data breaches and system compromise. A promising strategy for monitoring system activities involves analyzing volatile memory. This study proposes a rootkit detection model that combines memory analysis with Machine Learning (ML) and Deep Learning (DL) techniques. The model aims to identify suspicious patterns and behaviors associated with rootkits by analyzing the contents of a system’s volatile memory. To train the model, a diverse dataset of known rootkit samples is employed, and ML and deep learning algorithms are utilized. Through extensive experimentation and evaluation using SVM, RF, DT, k-NN, and LSTM algorithms, it is determined that SVM achieves the highest accuracy rate of 96.2%, whereas Execution Time (ET) shows that k-NN depicts the best performance, and LSTM (a DL model) shows the worst performance among the tested algorithms. This research contributes to the development of advanced defense mechanisms and enhances system security against the constantly evolving threat of rootkit attacks.
Subject
Fluid Flow and Transfer Processes,Computer Science Applications,Process Chemistry and Technology,General Engineering,Instrumentation,General Materials Science
Reference26 articles.
1. Manap, S. (2020, April 06). Rootkit: Attacker Undercover Tools. Available online: http://forum.ouah.org/salirootkit.pdf.
2. Bickford, J., O’Hare, R., Baliga, A., Ganapathy, V., and Iftode, L. (2010, January 22–23). Rootkits on smartphones. Proceedings of the Eleventh Workshop on Mobile Computing Systems Applications-HotMobile ’10, Annapolis, MD, USA.
3. Bunten, A. (2023, March 31). UNIX and Linux based Rootkits Techniques and Countermeasures. Available online: https://www.semanticscholar.org/paper/UNIXand-Linux-based-Rootkits-Techniques-and-Bunten/.
4. Huseynov, H., Saadawi, T., and Kourai, K. (2021). Hardening the Security of Multi-Access Edge Computing through Bio-Inspired VM Introspection. Big Data Cogn. Comput., 5.
5. On building machine learning pipelines for Android malware detection: A procedural survey of practices, challenges and opportunities;Koushki;Cybersecurity,2022