Stealthy Trojan Horse Detection Method Based on System Call Hook
Yue Cao · Jisuanji gongcheng · 2007
Trojan horses design essence lies in hijacking execution routine,and most of current detection methods fail to completely identify such ever-increasingly covert Trojan horses.The paper presents an approach to detect the existence of system call hooks set by Trojan horses based on the locality and determinacy of execution flows,and the analysis of system function call labs in both user and kernel levels,then designs and realizes corresponding prototype.Compared with current detections,the method offsets the deficiency in identifying unknown Trojan horses with more complete detection results.