Survey on Malware and Rootkit Detection

Abstract

Malwares are malicious software, designed to damage computer systems without the knowledge of the owner. Rootkit is also malicious software which hides the existence of certain processes or programs from normal methods of detection and enables continued privileged access to a computer. Now a day the impact of malware and rootkit is getting worst. Their detection is difficult because malicious program may be able to subvert the software that is intended to find it. Detection methods uses an alternative and trusted operating system, signature scanning behavioral-based methods, difference scanning, and memory dump analysis etc. Malware and rootkit detectors are the primary tools in defense against malicious programs. The quality of such a detector is determined by the techniques used by it. There are mainly two types of techniques to detect the malwares, signature based and anomaly based techniques. Signature-based detection is a malware detection approach that identifies a malware instance by the presence of at least one byte code pattern present in a database of signatures from known malicious programs. If a program contains a pattern that already exists within the database, it is deemed. In anomaly based detection malwares are classified according to some heuristics and rules. This survey study about signature based and anomaly based malware detection and list their strengths and limitations. It also compares techniques and helps to choose a desirable technique for secure system.