Detecting rootkits with the RAI runtime application inventory

Abstract

Remotely determining which precise code is running on which machines is hard. This is especially true if the monitored machines lack modern security features and may be under malware attack, since in such a scenario the malware may have already manipulated applications and operating systems. Existing approaches to this problem are heavyweight and have a large attack surface, which is frequently attacked by both applications and malware. To address this problem, this paper introduces RAI, a lightweight code monitoring tool that is especially wellsuited for legacy systems. While potentially useful for many software maintenance tasks, this paper applies RAI for detecting ongoing rootkit attacks. Specifically, in our experiments on several user and kernel mode rootkits, our approach achieved with moderate overhead and a relatively low false positive rate a 100% rootkit detection rate.