Detection of Hidden Processes Caused by Volatile Kernel Rootkits in Cloud Environments

The rootkit industry has evolved over the past decade, with attackers preferring to establish backdoors for repeated exploits instead of traditional one-time attacks. As intrusion detection technology advances, the demand for stealthy rootkits has increased, as they conceal their presence by modifying processes and files. Identifying mutated rootkits is challenging. To address this, we proposed the VKRHPDV (Volatile Kernel Rootkit Hidden Process Detection) framework, which utilizes process monitors, comparison analysts, and data gathering to detect hidden processes. This system distinguishes clean processes from those infected by rootkits. Performance analysis on 64 rootkit datasets across UNIX and Windows kernels in a cloud environment demonstrated VKRHPDV's efficacy in identifying process hiding behaviors swiftly.