Rootkit detection by using HW resources to detect inconsistencies in network traffic

摘要

A technique allows detection of covert malware that attempts to hide network traffic. By monitoring network traffic both in a secure trusted environment and in an operating system environment, then comparing the monitor data, attempts to hide network traffic can be detected, allowing the possibility of performing rehabilitative actions on the computer system to locate and remove the malware hiding the network traffic.

主权项

1. A non-transitory computer readable medium with instructions stored thereon, the instructions comprising instructions that when executed cause a programmable device to:
monitor network traffic of the programmable device in an environment controlled by an operating system of the programmable device, producing a first monitor data; monitor network traffic of the programmable device in a cryptographically secured hardware environment of the programmable device not controlled by the operating system, producing a second monitor data; compare the first monitor data with the second monitor data; and indicate whether the first monitor data is the same as the second monitor data.