A Host Based Kernel Level Rootkit Detection Mechanism Using Clustering Technique

摘要: Rootkits are a set of software tools used by an attacker to gain unauthorized access into system, thereby providing him with privilege sensitive data, conceal its own existence and allowing install other malicious software. They difficult detect due their elusive nature. Modern rootkit attacks mainly focus on modifying operating system kernel. Existing techniques for detection rely saving the state before comparing it infected state. Efficient is possible properly differentiating non activities taking place in In this paper we present novel anomaly method kernel level rootkits based k-means clustering algorithm.