{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,7,30]],"date-time":"2025-07-30T14:13:10Z","timestamp":1753884790178,"version":"3.41.2"},"reference-count":15,"publisher":"World Scientific Pub Co Pte Ltd","issue":"04","funder":[{"name":"Key Laboratory of PK System Technologies Research of Hainan"},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62141212","62133014","61972139","61932010"],"award-info":[{"award-number":["62141212","62133014","61972139","61932010"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100004735","name":"Natural Science Foundation of Hunan Province","doi-asserted-by":"crossref","award":["2021JJ30150","2022JJ10021"],"award-info":[{"award-number":["2021JJ30150","2022JJ10021"]}],"id":[{"id":"10.13039\/501100004735","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100005230","name":"Natural Science Foundation of Chongqing","doi-asserted-by":"crossref","award":["cstc2021jcyj-msxmX0461","CSTB2022NSCQ-MSX1393"],"award-info":[{"award-number":["cstc2021jcyj-msxmX0461","CSTB2022NSCQ-MSX1393"]}],"id":[{"id":"10.13039\/501100005230","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["J CIRCUIT SYST COMP"],"published-print":{"date-parts":[[2024,3,15]]},"abstract":"<jats:p> The concealment of rootkits makes them a significant security threat. Kernel-level rootkits can be extremely dangerous as they have high system privileges. A typical type of kernel-level rootkits is to hook system calls which are essential for overall system functionality. This paper presents drootkit, a tool to detect kernel-level rootkits that hook system calls. Additionally, drootkit can recover damaged systems. This tool utilizes eBPF technology, ensuring both flexibility and security. When installing new kernel modules, the virtual address range of the initial kernel code will not be affected. In light of this, drootkit conducts bounds checking on all system calls within the system. In the case of system calls being hooked, drootkit can detect and recover them while issuing warning messages. For testing purposes, this paper also implements a malicious kernel module that can hook system calls and run on the arm64 platform. We have conducted an experiment that confirms drootkit\u2019s capability to detect rootkits while also effectively restoring the system. Moreover, drootkit has very low system overhead and does not significantly affect system performance, making it a reliable choice for a backend program that can run for an extended period of time. <\/jats:p>","DOI":"10.1142\/s0218126624500737","type":"journal-article","created":{"date-parts":[[2023,8,12]],"date-time":"2023-08-12T04:13:13Z","timestamp":1691813593000},"source":"Crossref","is-referenced-by-count":0,"title":["Drootkit: Kernel-Level Rootkit Detection and Recovery Based on eBPF"],"prefix":"10.1142","volume":"33","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-7711-5837","authenticated-orcid":false,"given":"Xingyu","family":"hu","sequence":"first","affiliation":[{"name":"Key Laboratory for Embedded and Network Computing of Hunan Province, College of Computer Science and Electronic Engineering, Hunan University, Changsha, Hunan 410082, P. R. China"},{"name":"Research Institute of Hunan University in Chongqing, Chongqing 401120, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-8380-620X","authenticated-orcid":false,"given":"Ming","family":"Huang","sequence":"additional","affiliation":[{"name":"China Electronics Corporation Hainan Joint, Innovation Research Institute Co. Ltd, Chengmai, Hainan 571900, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-1288-963X","authenticated-orcid":false,"given":"Youhua","family":"Xue","sequence":"additional","affiliation":[{"name":"China Electronics Corporation Hainan Joint, Innovation Research Institute Co. Ltd, Chengmai, Hainan 571900, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-6226-2000","authenticated-orcid":false,"given":"Lifeng","family":"Jiang","sequence":"additional","affiliation":[{"name":"China Electronics Corporation Hainan Joint, Innovation Research Institute Co. Ltd, Chengmai, Hainan 571900, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3757-705X","authenticated-orcid":false,"given":"Yao","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Tourism Data, Guilin Tourism University, 26 Liangfeng Road, Yanshan District, Guilin City, Guangxi 541006, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6625-0350","authenticated-orcid":false,"given":"Guoqi","family":"Xie","sequence":"additional","affiliation":[{"name":"Key Laboratory for Embedded and Network Computing of Hunan Province, College of Computer Science and Electronic Engineering, Hunan University, Changsha, Hunan 410082, P. R. China"},{"name":"Research Institute of Hunan University in Chongqing, Chongqing 401120, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"219","published-online":{"date-parts":[[2023,9,30]]},"reference":[{"key":"S0218126624500737BIB001","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-73742-3_6"},{"key":"S0218126624500737BIB004","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3052999"},{"key":"S0218126624500737BIB005","doi-asserted-by":"publisher","DOI":"10.14232\/actacyb.288834"},{"key":"S0218126624500737BIB009","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2006.11"},{"volume-title":"Rootkits: Subverting the Windows Kernel","year":"2005","author":"Hoglund G.","key":"S0218126624500737BIB013"},{"key":"S0218126624500737BIB016","doi-asserted-by":"publisher","DOI":"10.1145\/1519065.1519072"},{"key":"S0218126624500737BIB017","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653728"},{"key":"S0218126624500737BIB020","doi-asserted-by":"publisher","DOI":"10.1145\/3411495.3421358"},{"key":"S0218126624500737BIB022","doi-asserted-by":"publisher","DOI":"10.1145\/224056.224075"},{"key":"S0218126624500737BIB023","doi-asserted-by":"publisher","DOI":"10.1145\/504390.504408"},{"key":"S0218126624500737BIB024","first-page":"15","volume-title":"USENIX Annual Technical Conference","author":"Cantrill B. M.","year":"2004"},{"key":"S0218126624500737BIB025","first-page":"259","volume-title":"USENIX Winter \u201993 Conf.","author":"McCanne S.","year":"1993"},{"volume-title":"BPF Performance Tools: Linux System and Application Observability","year":"2019","author":"Gregg B.","key":"S0218126624500737BIB026"},{"key":"S0218126624500737BIB027","doi-asserted-by":"publisher","DOI":"10.1109\/CloudIntelligence52565.2021.00014"},{"volume-title":"17th SSTIC Symposium sur la S\u00e9curit\u00e9 des Technologies de l\u2019Information et de la Communication","author":"Fournier G.","key":"S0218126624500737BIB028"}],"container-title":["Journal of Circuits, Systems and Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.worldscientific.com\/doi\/pdf\/10.1142\/S0218126624500737","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,19]],"date-time":"2024-03-19T05:48:35Z","timestamp":1710827315000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.worldscientific.com\/doi\/10.1142\/S0218126624500737"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,9,30]]},"references-count":15,"journal-issue":{"issue":"04","published-print":{"date-parts":[[2024,3,15]]}},"alternative-id":["10.1142\/S0218126624500737"],"URL":"https:\/\/doi.org\/10.1142\/s0218126624500737","relation":{},"ISSN":["0218-1266","1793-6454"],"issn-type":[{"type":"print","value":"0218-1266"},{"type":"electronic","value":"1793-6454"}],"subject":[],"published":{"date-parts":[[2023,9,30]]},"article-number":"2450073"}}