Research On Detect Technology Of Windows System Kernel Rootkit

With fast development of computer technology and the rapid prevalence of the Internet,computer systems are confronted with more and more damages from malwares,such as virus,trojan and worm, and a technology called Rootkit are used both by malware and security software,which makes the conflict between them spill over into the kernel of Windows system.It is a practicable solution against kernel Rootkit to check the integrity of kernel function and the integrity of function address table,such as system service descriptor table and interrupt descriptor table.But it is very diffcult to locate which function the kernel execution is redirected to.Besides,there are so many true positives and false negatives using this method,wich makes common users confused. Some undocumented kernel data strucures can be used to detect kernel Rootkits,wich also can be used by kernel Rootkit to bypass these detect methods based on these structures.Based on the characteristics of Windows system kernel Rootkit and analysis of detect method against Rootkit now available,combined with the research on WRK source code and Rootkit samples with a large number,new detect methods against Rootkit based inline hook,outline hook and direct kernel object manipulation were delivered,which were implemented in a detect sofaware.And an advanced pattern matching algorithm based on BM algorithm is used to enhance the efficiency of Rootkit detection.The test result against several Windows Rootkit samples proves that new detect methods delivered in this paper have advantages in accuracy and stability on the detect of Rootkit both based on kernel hook and direct kernel object manipulation compared to the test result from other detect tool on Windows platform.