A new procedure to help system/network administrators identify multiple rootkit infections

Desmond Lobo; Paul Watters; Xin Wen Wu

doi:10.1109/ICCSN.2010.14

A new procedure to help system/network administrators identify multiple rootkit infections

Desmond Lobo^*, Paul Watters, Xin Wen Wu

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

4 Citations (Scopus)

Abstract

Rootkits refer to software that is used to hide the presence of malware from system/network administrators and permit an attacker to take control of a computer. In our previous work, we designed a system that would categorize rootkits based on the hooks that had been created. Focusing on rootkits that use inline function hooking techniques, we showed that our system could successfully categorize a sample of rootkits using unsupervised EM clustering. In this paper, we extend our previous work by outlining a new procedure to help system/network administrators identify the rootkits that have infected their machines. Using a logistic regression model for profiling families of rootkits, we were able to identify at least one of the rootkits that had infected each of the systems that we tested.

Original language	English
Title of host publication	Proceedings
Subtitle of host publication	Second International Conference on Communication Software and Networks
Place of Publication	Piscataway, USA
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Pages	124-128
Number of pages	5
ISBN (Print)	9780769539614
DOIs	https://doi.org/10.1109/ICCSN.2010.14
Publication status	Published - 2010
Externally published	Yes
Event	International Conference on Communication Software and Networks (2nd: 2010) - Singapore, Singapore Duration: 26 Feb 2010 → 28 Feb 2010

Conference

Conference	International Conference on Communication Software and Networks (2nd: 2010)
Abbreviated title	ICCSN 2010
Country/Territory	Singapore
City	Singapore
Period	26/02/10 → 28/02/10

Keywords

Logistic regression
Malware
Network security
Profiling
Rootkits

Access to Document

10.1109/ICCSN.2010.14

Cite this

@inproceedings{fb9704b5dce34e169fdc6fb050b1860e,

title = "A new procedure to help system/network administrators identify multiple rootkit infections",

abstract = "Rootkits refer to software that is used to hide the presence of malware from system/network administrators and permit an attacker to take control of a computer. In our previous work, we designed a system that would categorize rootkits based on the hooks that had been created. Focusing on rootkits that use inline function hooking techniques, we showed that our system could successfully categorize a sample of rootkits using unsupervised EM clustering. In this paper, we extend our previous work by outlining a new procedure to help system/network administrators identify the rootkits that have infected their machines. Using a logistic regression model for profiling families of rootkits, we were able to identify at least one of the rootkits that had infected each of the systems that we tested.",

keywords = "Logistic regression, Malware, Network security, Profiling, Rootkits",

author = "Desmond Lobo and Paul Watters and Wu, \{Xin Wen\}",

year = "2010",

doi = "10.1109/ICCSN.2010.14",

language = "English",

isbn = "9780769539614",

pages = "124--128",

booktitle = "Proceedings",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

address = "United States",

note = "International Conference on Communication Software and Networks (2nd: 2010), ICCSN 2010 ; Conference date: 26-02-2010 Through 28-02-2010",

}

Lobo, D, Watters, P & Wu, XW 2010, A new procedure to help system/network administrators identify multiple rootkit infections. in Proceedings: Second International Conference on Communication Software and Networks., 5437619, Institute of Electrical and Electronics Engineers (IEEE), Piscataway, USA, pp. 124-128, International Conference on Communication Software and Networks (2nd: 2010), Singapore, Singapore, 26/02/10. https://doi.org/10.1109/ICCSN.2010.14

A new procedure to help system/network administrators identify multiple rootkit infections. / Lobo, Desmond; Watters, Paul; Wu, Xin Wen.
Proceedings: Second International Conference on Communication Software and Networks. Piscataway, USA: Institute of Electrical and Electronics Engineers (IEEE), 2010. p. 124-128 5437619.

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

TY - GEN

T1 - A new procedure to help system/network administrators identify multiple rootkit infections

AU - Lobo, Desmond

AU - Watters, Paul

AU - Wu, Xin Wen

PY - 2010

Y1 - 2010

N2 - Rootkits refer to software that is used to hide the presence of malware from system/network administrators and permit an attacker to take control of a computer. In our previous work, we designed a system that would categorize rootkits based on the hooks that had been created. Focusing on rootkits that use inline function hooking techniques, we showed that our system could successfully categorize a sample of rootkits using unsupervised EM clustering. In this paper, we extend our previous work by outlining a new procedure to help system/network administrators identify the rootkits that have infected their machines. Using a logistic regression model for profiling families of rootkits, we were able to identify at least one of the rootkits that had infected each of the systems that we tested.

AB - Rootkits refer to software that is used to hide the presence of malware from system/network administrators and permit an attacker to take control of a computer. In our previous work, we designed a system that would categorize rootkits based on the hooks that had been created. Focusing on rootkits that use inline function hooking techniques, we showed that our system could successfully categorize a sample of rootkits using unsupervised EM clustering. In this paper, we extend our previous work by outlining a new procedure to help system/network administrators identify the rootkits that have infected their machines. Using a logistic regression model for profiling families of rootkits, we were able to identify at least one of the rootkits that had infected each of the systems that we tested.

KW - Logistic regression

KW - Malware

KW - Network security

KW - Profiling

KW - Rootkits

UR - https://www.scopus.com/pages/publications/77952403288

U2 - 10.1109/ICCSN.2010.14

DO - 10.1109/ICCSN.2010.14

M3 - Conference proceeding contribution

AN - SCOPUS:77952403288

SN - 9780769539614

SP - 124

EP - 128

BT - Proceedings

PB - Institute of Electrical and Electronics Engineers (IEEE)

CY - Piscataway, USA

T2 - International Conference on Communication Software and Networks (2nd: 2010)

Y2 - 26 February 2010 through 28 February 2010

ER -

A new procedure to help system/network administrators identify multiple rootkit infections

Abstract

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this