RBACS: Rootkit Behavioral Analysis and Classification System

Desmond Lobo; Paul Watters; Xinwen Wu

doi:10.1109/WKDD.2010.23

RBACS: Rootkit Behavioral Analysis and Classification System

Desmond Lobo^*, Paul Watters, Xinwen Wu

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

17 Citations (Scopus)

Abstract

In this paper, we focus on rootkits, a special type of malicious software (malware) that operates in an obfuscated and stealthy mode to evade detection. Categorizing these rootkits will help in detecting future attacks against the business community. We first developed a theoretical framework for classifying rootkits. Based on our theoretical framework, we then proposed a new rootkit classification system and tested our system on a sample of rootkits that use inline function hooking. Our experimental results showed that our system could successfully categorize the sample using unsupervised clustering.

Original language	English
Title of host publication	Proceedings: Third International Conference on Knowledge Discovery and Data Mining
Editors	Mingmin Gong, Qi Luo
Place of Publication	Piscataway, USA
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Pages	75-80
Number of pages	6
ISBN (Print)	9780769539232
DOIs	https://doi.org/10.1109/WKDD.2010.23
Publication status	Published - 2010
Externally published	Yes
Event	3rd International Conference on Knowledge Discovery and Data Mining, WKDD 2010 - Phuket, Thailand Duration: 9 Jan 2010 → 10 Jan 2010

Conference

Conference	3rd International Conference on Knowledge Discovery and Data Mining, WKDD 2010
Country/Territory	Thailand
City	Phuket
Period	9/01/10 → 10/01/10

Keywords

Behavioral analysis
Classification
Data mining
Malware
Rootkits

Access to Document

10.1109/WKDD.2010.23

Cite this

@inproceedings{b93e7eca7cb841cf8d0edb3f78040fca,

title = "RBACS: Rootkit Behavioral Analysis and Classification System",

abstract = "In this paper, we focus on rootkits, a special type of malicious software (malware) that operates in an obfuscated and stealthy mode to evade detection. Categorizing these rootkits will help in detecting future attacks against the business community. We first developed a theoretical framework for classifying rootkits. Based on our theoretical framework, we then proposed a new rootkit classification system and tested our system on a sample of rootkits that use inline function hooking. Our experimental results showed that our system could successfully categorize the sample using unsupervised clustering.",

keywords = "Behavioral analysis, Classification, Data mining, Malware, Rootkits",

author = "Desmond Lobo and Paul Watters and Xinwen Wu",

year = "2010",

doi = "10.1109/WKDD.2010.23",

language = "English",

isbn = "9780769539232",

pages = "75--80",

editor = "Mingmin Gong and Qi Luo",

booktitle = "Proceedings: Third International Conference on Knowledge Discovery and Data Mining",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

address = "United States",

note = "3rd International Conference on Knowledge Discovery and Data Mining, WKDD 2010 ; Conference date: 09-01-2010 Through 10-01-2010",

}

Lobo, D, Watters, P & Wu, X 2010, RBACS: Rootkit Behavioral Analysis and Classification System. in M Gong & Q Luo (eds), Proceedings: Third International Conference on Knowledge Discovery and Data Mining., 5432724, Institute of Electrical and Electronics Engineers (IEEE), Piscataway, USA, pp. 75-80, 3rd International Conference on Knowledge Discovery and Data Mining, WKDD 2010, Phuket, Thailand, 9/01/10. https://doi.org/10.1109/WKDD.2010.23

RBACS: Rootkit Behavioral Analysis and Classification System. / Lobo, Desmond; Watters, Paul; Wu, Xinwen.
Proceedings: Third International Conference on Knowledge Discovery and Data Mining. ed. / Mingmin Gong; Qi Luo. Piscataway, USA: Institute of Electrical and Electronics Engineers (IEEE), 2010. p. 75-80 5432724.

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

TY - GEN

T1 - RBACS

T2 - 3rd International Conference on Knowledge Discovery and Data Mining, WKDD 2010

AU - Lobo, Desmond

AU - Watters, Paul

AU - Wu, Xinwen

PY - 2010

Y1 - 2010

N2 - In this paper, we focus on rootkits, a special type of malicious software (malware) that operates in an obfuscated and stealthy mode to evade detection. Categorizing these rootkits will help in detecting future attacks against the business community. We first developed a theoretical framework for classifying rootkits. Based on our theoretical framework, we then proposed a new rootkit classification system and tested our system on a sample of rootkits that use inline function hooking. Our experimental results showed that our system could successfully categorize the sample using unsupervised clustering.

AB - In this paper, we focus on rootkits, a special type of malicious software (malware) that operates in an obfuscated and stealthy mode to evade detection. Categorizing these rootkits will help in detecting future attacks against the business community. We first developed a theoretical framework for classifying rootkits. Based on our theoretical framework, we then proposed a new rootkit classification system and tested our system on a sample of rootkits that use inline function hooking. Our experimental results showed that our system could successfully categorize the sample using unsupervised clustering.

KW - Behavioral analysis

KW - Classification

KW - Data mining

KW - Malware

KW - Rootkits

UR - https://www.scopus.com/pages/publications/77952123777

U2 - 10.1109/WKDD.2010.23

DO - 10.1109/WKDD.2010.23

M3 - Conference proceeding contribution

AN - SCOPUS:77952123777

SN - 9780769539232

SP - 75

EP - 80

BT - Proceedings: Third International Conference on Knowledge Discovery and Data Mining

A2 - Gong, Mingmin

A2 - Luo, Qi

PB - Institute of Electrical and Electronics Engineers (IEEE)

CY - Piscataway, USA

Y2 - 9 January 2010 through 10 January 2010

ER -

RBACS: Rootkit Behavioral Analysis and Classification System

Abstract

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this