Formal model proposal for (malware) program stealth
Eric Filiol Virology and Cryptology Lab, Army Signals Academy
Recent advances in stealth techniques have dramatically increased the malware hazard. More recently, rootkits like
SubVirt or BluePill have strongly challenged the classical capabilities of malware detection.
In this paper, we formalize stealth and rootkits technologies in a far different way that those typically considered,
that is to say as a more or less complex set of hooking and kernel subversions.
By comparing stealth or rootkits to steganographic techniques, we propose a new information theoretic-based
formalisation that enables us to define the problem of stealth detection in a more powerful and high level way than
the existing ones.
Consequently, it yields new perspectives of what detection of stealth really is and how to address the relevant
problem on a practical basis. In particular, this modelling gives clues and potential practical approaches to
detect the most recent rootkit techniques like SubVirt or BluePill.
del.icio.us 
digg this
