Application of a methodology to characterize rootkits retrieved from honeynets

Proceedings fron the Fifth Annual IEEE System, Man and Cybernetics Information Assurance Workshop, SMC

Volumn , Issue , 2004, Pages 15-21

  Levine, John ^a   Grizzard, Julian ^a   Owen, Henry ^a  

^a NONE

Author keywords

Forensics; Honeynet; Rootkits; Signatures

Indexed keywords

COMPUTER OPERATING SYSTEMS; COMPUTER SYSTEMS; DATA PRIVACY; DATA PROCESSING; INFORMATION MANAGEMENT; SECURITY OF DATA;

FORENSICS; HONEYNET; NETWORK SECURITY; ROOTKITS; SIGNATURES;

COMPUTER NETWORKS;

EID: 15944384236     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (16)

1. D. Dettrich, (2002, 5 JAN) "Root Kits" and hiding files directories/processes after a break-in, [Online]. Available: http://staff.washington.edu/dittrich/misc/faqs/rootkits.faq
2. L. Spitzner, Honeypots- Tracking Hackers, Indianapolis, IN: Addison-Wesley, 2003, p. 69.
3. The Honeynet Project, Know Your Enemy, Indianapolis, IN: Addison-Wesley, 2002, p. 19.
4. http://www.linuxsecurity.com/feature_stories/feature_story-141.html. Nov 2003.
5. http://www.packetfu.org/hpa.html, Nov 2003.
6. nd International Information Assurance Workshop, Charlotte, NC, 8-9 Apr 2004.
7. http://la-samhna.de/library/rootkits/detect.html, Sep 2003
8. J. Levine, J. Grizzard, P. Hutto, H. Owen, "A Methodology to Characterize Kernel Level Rootkit Exploits that Overwrite the System Call Table", to be presented at SoutheastCon 2004, Greensboro NC, 26-28 Mar, 2004.
9. http://www.chkrootkit.org, Dec 2003.
10. Zovi, D., "Kernel Rootkits", http://www.cs.unm.edu/~ghandi/lkr. pdf, 3 July 2001, Oct 2003.
11. http://www.cs.tut.fi/~rammer/aide.html, Sep 2002.
12. Thimbleby, S. Anderson, p. Cairns, "A Framework for Modeling Trojans and Computer Virus Infections," The Computer Journal, vol. 41, no.7 pp. 444-458, 1998.
13. http://www.honeylux.org.lu/project/honeyluxR1/result/sub01/report/hax. html, Aug 2003.
14. http://packetstormsecurity.nl/trojans/indexdate.shtml/clean-osf.8759.tez/ README, Dec 2003.
15. J. Levine, H. Owen, B. Culver, "A Methodology for Detecting New Binary Rootkit Exploits", presented at the 2003 IEEE SoutheastCon 2003, Ocho Rios, Jamaica, 4-6 Apr 2003.
16. J. Levine, A Methodology for Detecting and Classifying Rootkit Exploits, PhD Thesis, Georgia Institute of Technology, Atlanta, GA, to be published.