Journal of Information Processing
Online ISSN : 1882-6652
ISSN-L : 1882-6652
The Evolution of Process Hiding Techniques in Malware - Current Threats and Possible Countermeasures
Sebastian EresheimRobert LuhSebastian Schrittwieser
Author information

2017 Volume 25 Pages 866-874


Rootkits constitute a significant threat to modern computing and information systems. Since their first appearance in the early 1990's they have steadily evolved, adapting to ever-improving security measures. The main feature rootkits have in common is the ability to hide their malicious presence and activities from the operating system and its legitimate users. In this paper we systematically analyze process hiding techniques routinely used by rootkit malware. We summarize the characteristics of different approaches and discuss their advantages and limitations. Furthermore, we assess detection and prevention techniques introduced in operating systems in response to the threat of hidden malware. The results of our assessments show that defenders still struggle to keep up with rootkit authors. At the same time we see a shift towards powerful VM-based techniques that will continue to evolve over the coming years.

Content from these authors
© 2017 by the Information Processing Society of Japan
Previous article Next article