An Effective Method for Protecting Native API Hook Attacks in User-mode

K. Muthumanickam ； E. Ilavarasan

《Research Journal of Applied Sciences, Engineering and Technology》 9卷1期 (2015/01) Pp. 33-39

並列摘要

Today, many modern malware developers is taking the advantage of Application Programming Interface (API) hook technique to take the control of the victim computer which making it difficult to detect their presence. Because of the sophistication of rootkit tools, a remote attacker can use native API to compromise any computer which can later be used for many illegal activities such as sniffing network lines, capturing passwords, sending spam and DDoS attack, etc. Thus to protect end-system by identifying and preventing native API malicious code hooking is a challenging problem to the defenders. Today, many different malware-analysis tools incur specific features against malwares but manual and error-prone. In this study, we proposed a behavior-based monitoring detection system to effectively deal native API hooks in user-mode. Unlike other malware identification techniques, our approach involved dynamically analyzing the behavior of native API call hooking malwares. Comparing our experimental evaluation results with existing tools show better performance with no false positive.

並列關鍵字

API hook ； dynamic analysis ； malicious code ； rootkit ； user-mode