文件名称：Automated containment of rootkits attacks 自動抵禦rootkis 攻擊
文件大小：575KB
文件格式：PDF
更新时间：2011-11-10 20:02:22
Rootkits Stealth malware Intrusion Virtual
自動抵禦rootkis 攻擊 Rootkit attacks are a serious threat to computer systems. Packaged with other malwares such as worms, viruses and spyware, rootkits pose a more potent threat than ever before by allowing malware to evade detection. In the absence of appropriate tools to counter such attacks, compromised machines stay undetected for extended periods of time. Leveraging virtual machine technology, we propose a solution for real-time automated detection and containment of rootkit attacks. We have developed a prototype using VMware Workstation to illustrate the solution. Our analysis and experimental results indicate that this approach can very successfully detect and contain the effects of a large percentage of rootkits found for Linux today. We also demonstrate with an example, how this approach is particularly effective against malwares that use rootkits to hide.