Formal model proposal for (malware) program stealth

Eric Filiol Virology and Cryptology Lab, Army Signals Academy

  download slides (PDF)

Recent advances in stealth techniques have dramatically increased the malware hazard. More recently, rootkits like SubVirt or BluePill have strongly challenged the classical capabilities of malware detection.

In this paper, we formalize stealth and rootkits technologies in a far different way that those typically considered, that is to say as a more or less complex set of hooking and kernel subversions.

By comparing stealth or rootkits to steganographic techniques, we propose a new information theoretic-based formalisation that enables us to define the problem of stealth detection in a more powerful and high level way than the existing ones. Consequently, it yields new perspectives of what detection of stealth really is and how to address the relevant problem on a practical basis. In particular, this modelling gives clues and potential practical approaches to detect the most recent rootkit techniques like SubVirt or BluePill.


We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.