A method for detecting Linux kernel moduler rootkits

Abstract

Several methods exist for detecting Linux kernel module (LKM) rootkits, most of which rely on a priori system-specific knowledge. We propose an alternative detection technique that only requires knowledge of the distribution of system call addresses in an uninfected system. Our technique relies on outlier analysis, a statistical technique that compares the distribution of system call addresses in a suspect system to that in a known uninfected system. Experimental results indicate that it is possible to detect LKM rootkits with a high degree of confidence. © 2007 International Federation for Information Processing.