K-Tracer: A System for Extracting Kernel Malware Behavior.

摘要: Kernel rootkits can provide user level-malware programs with the additional capabilities of hiding their malicious activities by altering legitimate kernel behavior an operating system. While existing research has studied rootkit hooking in effort to help develop defense and remediation mechanisms, automated analysis actual goals not been adequately investigated. In this paper, we present approach based on a combination backward slicing chopping techniques that enables automatic discovery system data manipulation behaviors rootkits. We have built called K-Tracer dynamically analyze Windows kernel-level code extract from rootkits, including sensitive access, modification triggers. Our overcomes several challenges analyzing Kernel. performed experiments malware samples shown our successfully all them. also discuss limitations current newer strategies, insight into how it be extended handle these