Detecting stealth software with Strider GhostBuster

摘要: Stealth malware programs that silently infect enterprise and consumer machines are becoming a major threat to the future of Internet. Resource hiding is powerful stealth technique commonly used by evade detection computer users anti-malware scanners. In this paper, we focus on subclass malware, termed "ghostware", which hide files, configuration settings, processes, loaded modules from operating system's query enumeration application programming interfaces (APIs). Instead targeting individual implementations, describe systematic framework for detecting multiple types hidden resources leveraging behavior as mechanism. Specifically, adopt cross-view diff-based approach ghostware comparing high-level infected scan with low-level clean alternatively an inside-the-box outside-the-box scan. We design implementation Strider GhostBuster tool demonstrate its efficiency effectiveness in real-world such rootkits, Trojans, key-loggers.