Mechanism and implementation of Rootkit attack and defense - Fujuan LI; Qun WANG (Dianxin kexue)
Rootkit is a set of malicious codes that can attack the system kernel and achieve deep hiding,which has posed serious threats to cyber security.Firstly,the basic features of Rootkit/Bootkit were introduced,and the characteristics of Rootkit attacks in user mode and kernel mode were compared and analyzed.Thereafter,the implementation principles and working mechanisms of Hook,DKOM and virtualization technologies involved in Rootkit attacks were emphatically analyzed.Combined with the specific attack behaviors,the main detection methods and defense techniques for Rootkit attacks were discussed at the end.