{"id":"https://openalex.org/W4385781435","doi":"https://doi.org/10.1142/s0218126624500737","title":"Drootkit: Kernel-Level Rootkit Detection and Recovery Based on eBPF","display_name":"Drootkit: Kernel-Level Rootkit Detection and Recovery Based on eBPF","publication_year":2023,"publication_date":"2023-08-12","ids":{"openalex":"https://openalex.org/W4385781435","doi":"https://doi.org/10.1142/s0218126624500737"},"language":"en","primary_location":{"id":"doi:10.1142/s0218126624500737","is_oa":false,"landing_page_url":"http://dx.doi.org/10.1142/s0218126624500737","pdf_url":null,"source":{"id":"https://openalex.org/S167602672","display_name":"Journal of Circuits Systems and Computers","issn_l":"0218-1266","issn":["0218-1266","1793-6454"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319815","host_organization_name":"World Scientific","host_organization_lineage":["https://openalex.org/P4310319815"],"host_organization_lineage_names":["World Scientific"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Circuits, Systems and Computers","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5030217631","display_name":"X. R. Hu","orcid":"https://orcid.org/0009-0002-7711-5837"},"institutions":[{"id":"https://openalex.org/I16609230","display_name":"Hunan University","ror":"https://ror.org/05htk5m33","country_code":"CN","type":"education","lineage":["https://openalex.org/I16609230"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xingyu hu","raw_affiliation_strings":["Key Laboratory for Embedded and Network Computing of Hunan Province, College of Computer Science and Electronic Engineering, Hunan University, Changsha, Hunan 410082, P. R. China","Research Institute of Hunan University in Chongqing, Chongqing 401120, P. R. China"],"raw_orcid":"https://orcid.org/0009-0002-7711-5837","affiliations":[{"raw_affiliation_string":"Key Laboratory for Embedded and Network Computing of Hunan Province, College of Computer Science and Electronic Engineering, Hunan University, Changsha, Hunan 410082, P. R. China","institution_ids":["https://openalex.org/I16609230"]},{"raw_affiliation_string":"Research Institute of Hunan University in Chongqing, Chongqing 401120, P. R. China","institution_ids":["https://openalex.org/I16609230"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068289886","display_name":"Ming Huang","orcid":"https://orcid.org/0009-0000-8380-620X"},"institutions":[{"id":"https://openalex.org/I4210104233","display_name":"China Electronics Corporation (China)","ror":"https://ror.org/00vsv8c52","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210104233"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ming Huang","raw_affiliation_strings":["China Electronics Corporation Hainan Joint, Innovation Research Institute Co. Ltd, Chengmai, Hainan 571900, P. R. China"],"raw_orcid":"https://orcid.org/0009-0000-8380-620X","affiliations":[{"raw_affiliation_string":"China Electronics Corporation Hainan Joint, Innovation Research Institute Co. Ltd, Chengmai, Hainan 571900, P. R. China","institution_ids":["https://openalex.org/I4210104233"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005373732","display_name":"Youhua Xue","orcid":"https://orcid.org/0009-0009-1288-963X"},"institutions":[{"id":"https://openalex.org/I4210104233","display_name":"China Electronics Corporation (China)","ror":"https://ror.org/00vsv8c52","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210104233"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Youhua Xue","raw_affiliation_strings":["China Electronics Corporation Hainan Joint, Innovation Research Institute Co. Ltd, Chengmai, Hainan 571900, P. R. China"],"raw_orcid":"https://orcid.org/0009-0009-1288-963X","affiliations":[{"raw_affiliation_string":"China Electronics Corporation Hainan Joint, Innovation Research Institute Co. Ltd, Chengmai, Hainan 571900, P. R. China","institution_ids":["https://openalex.org/I4210104233"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102906169","display_name":"Lifeng Jiang","orcid":"https://orcid.org/0009-0005-6226-2000"},"institutions":[{"id":"https://openalex.org/I4210104233","display_name":"China Electronics Corporation (China)","ror":"https://ror.org/00vsv8c52","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210104233"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lifeng Jiang","raw_affiliation_strings":["China Electronics Corporation Hainan Joint, Innovation Research Institute Co. Ltd, Chengmai, Hainan 571900, P. R. China"],"raw_orcid":"https://orcid.org/0009-0005-6226-2000","affiliations":[{"raw_affiliation_string":"China Electronics Corporation Hainan Joint, Innovation Research Institute Co. Ltd, Chengmai, Hainan 571900, P. R. China","institution_ids":["https://openalex.org/I4210104233"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100753977","display_name":"Yao Liu","orcid":"https://orcid.org/0000-0003-3757-705X"},"institutions":[{"id":"https://openalex.org/I2800393352","display_name":"China Tourism Academy","ror":"https://ror.org/01k4abj61","country_code":"CN","type":"government","lineage":["https://openalex.org/I2800393352"]},{"id":"https://openalex.org/I4392738314","display_name":"Guilin Tourism University","ror":"https://ror.org/013a79z51","country_code":null,"type":"education","lineage":["https://openalex.org/I4392738314"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yao Liu","raw_affiliation_strings":["School of Tourism Data, Guilin Tourism University, 26 Liangfeng Road, Yanshan District, Guilin City, Guangxi 541006, P. R. China"],"raw_orcid":"https://orcid.org/0000-0003-3757-705X","affiliations":[{"raw_affiliation_string":"School of Tourism Data, Guilin Tourism University, 26 Liangfeng Road, Yanshan District, Guilin City, Guangxi 541006, P. R. China","institution_ids":["https://openalex.org/I2800393352","https://openalex.org/I4392738314"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5034516221","display_name":"Guoqi Xie","orcid":"https://orcid.org/0000-0001-6625-0350"},"institutions":[{"id":"https://openalex.org/I16609230","display_name":"Hunan University","ror":"https://ror.org/05htk5m33","country_code":"CN","type":"education","lineage":["https://openalex.org/I16609230"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Guoqi Xie","raw_affiliation_strings":["Key Laboratory for Embedded and Network Computing of Hunan Province, College of Computer Science and Electronic Engineering, Hunan University, Changsha, Hunan 410082, P. R. China","Research Institute of Hunan University in Chongqing, Chongqing 401120, P. R. China"],"raw_orcid":"https://orcid.org/0000-0001-6625-0350","affiliations":[{"raw_affiliation_string":"Key Laboratory for Embedded and Network Computing of Hunan Province, College of Computer Science and Electronic Engineering, Hunan University, Changsha, Hunan 410082, P. R. China","institution_ids":["https://openalex.org/I16609230"]},{"raw_affiliation_string":"Research Institute of Hunan University in Chongqing, Chongqing 401120, P. R. China","institution_ids":["https://openalex.org/I16609230"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5034516221"],"corresponding_institution_ids":["https://openalex.org/I16609230"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.09515545,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"33","issue":"04","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/rootkit","display_name":"Rootkit","score":0.9817891120910645},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6757503747940063},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.6346616148948669},{"id":"https://openalex.org/keywords/kernel","display_name":"Kernel (algebra)","score":0.5945248007774353},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.5678762197494507},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.5141854286193848},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.47286534309387207},{"id":"https://openalex.org/keywords/flexibility","display_name":"Flexibility (engineering)","score":0.45185035467147827},{"id":"https://openalex.org/keywords/linux-kernel","display_name":"Linux kernel","score":0.4223913252353668},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.4068385064601898},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.401503324508667}],"concepts":[{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.9817891120910645},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6757503747940063},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.6346616148948669},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.5945248007774353},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.5678762197494507},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5141854286193848},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.47286534309387207},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.45185035467147827},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.4223913252353668},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.4068385064601898},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.401503324508667},{"id":"https://openalex.org/C114614502","wikidata":"https://www.wikidata.org/wiki/Q76592","display_name":"Combinatorics","level":1,"score":0.0},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1142/s0218126624500737","is_oa":false,"landing_page_url":"http://dx.doi.org/10.1142/s0218126624500737","pdf_url":null,"source":{"id":"https://openalex.org/S167602672","display_name":"Journal of Circuits Systems and Computers","issn_l":"0218-1266","issn":["0218-1266","1793-6454"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319815","host_organization_name":"World Scientific","host_organization_lineage":["https://openalex.org/P4310319815"],"host_organization_lineage_names":["World Scientific"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Circuits, Systems and Computers","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.6100000143051147}],"awards":[{"id":"https://openalex.org/G1150607349","display_name":null,"funder_award_id":"2022JJ10021","funder_id":"https://openalex.org/F4320322843","funder_display_name":"Natural Science Foundation of\u00a0Hunan Province"},{"id":"https://openalex.org/G3359096647","display_name":null,"funder_award_id":"62133014","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G576546066","display_name":null,"funder_award_id":"61932010","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5893368050","display_name":null,"funder_award_id":"cstc2021jcyj-msxmX0461","funder_id":"https://openalex.org/F4320323172","funder_display_name":"Natural Science Foundation of Chongqing"},{"id":"https://openalex.org/G6357857991","display_name":null,"funder_award_id":"CSTB2022NSCQ-MSX1393","funder_id":"https://openalex.org/F4320323172","funder_display_name":"Natural Science Foundation of Chongqing"},{"id":"https://openalex.org/G6669917937","display_name":null,"funder_award_id":"2021JJ30150","funder_id":"https://openalex.org/F4320322843","funder_display_name":"Natural Science Foundation of\u00a0Hunan Province"},{"id":"https://openalex.org/G7115661225","display_name":null,"funder_award_id":"61972139","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8888455938","display_name":null,"funder_award_id":"62141212","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320322843","display_name":"Natural Science Foundation of\u00a0Hunan Province","ror":null},{"id":"https://openalex.org/F4320323172","display_name":"Natural Science Foundation of Chongqing","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W1492832459","https://openalex.org/W1578900479","https://openalex.org/W1972479252","https://openalex.org/W2002915275","https://openalex.org/W2065566278","https://openalex.org/W2110756602","https://openalex.org/W2140164463","https://openalex.org/W2602229646","https://openalex.org/W3006061521","https://openalex.org/W3094827892","https://openalex.org/W3190392843","https://openalex.org/W3197979949"],"related_works":["https://openalex.org/W1994712384","https://openalex.org/W4240186231","https://openalex.org/W2166844173","https://openalex.org/W2439951656","https://openalex.org/W3170525725","https://openalex.org/W1573526548","https://openalex.org/W2354398839","https://openalex.org/W2171038386","https://openalex.org/W2069600520","https://openalex.org/W1514297880"],"abstract_inverted_index":{"The":[0],"concealment":[1],"of":[2,25,79,90,106,191],"rootkits":[3,11,27,49,154],"makes":[4],"them":[5,116],"a":[6,44,128,177,181],"significant":[7],"security":[8],"threat.":[9],"Kernel-level":[10],"can":[12,56,112,133,185],"be":[13,86],"extremely":[14],"dangerous":[15],"as":[16],"they":[17],"have":[18,144],"high":[19],"system":[20,31,38,52,98,107,135,166,173],"privileges.":[21],"A":[22],"typical":[23],"type":[24],"kernel-level":[26,48],"is":[28],"to":[29,46,152],"hook":[30,51,134],"calls":[32,99,108,136],"which":[33],"are":[34],"essential":[35],"for":[36,180,187],"overall":[37],"functionality.":[39],"This":[40,60],"paper":[41,125],"presents":[42],"drootkit,":[43],"tool":[45,61],"detect":[47,113,153],"that":[50,132,148,184],"calls.":[53],"Additionally,":[54],"drootkit":[55,92,111,162],"recover":[57,115],"damaged":[58],"systems.":[59],"utilizes":[62],"eBPF":[63],"technology,":[64],"ensuring":[65],"both":[66],"flexibility":[67],"and":[68,114,137,168],"security.":[69],"When":[70],"installing":[71],"new":[72],"kernel":[73,82,130],"modules,":[74],"the":[75,80,101,104,140,159],"virtual":[76],"address":[77],"range":[78],"initial":[81],"code":[83],"will":[84],"not":[85,170],"affected.":[87],"In":[88,103],"light":[89],"this,":[91],"conducts":[93],"bounds":[94],"checking":[95],"on":[96,139],"all":[97],"within":[100],"system.":[102,160],"case":[105],"being":[109],"hooked,":[110],"while":[117,155],"issuing":[118],"warning":[119],"messages.":[120],"For":[121],"testing":[122],"purposes,":[123],"this":[124],"also":[126,156],"implements":[127],"malicious":[129],"module":[131],"run":[138,186],"arm64":[141],"platform.":[142],"We":[143],"conducted":[145],"an":[146,188],"experiment":[147],"confirms":[149],"drootkit\u2019s":[150],"capability":[151],"effectively":[157],"restoring":[158],"Moreover,":[161],"has":[163],"very":[164],"low":[165],"overhead":[167],"does":[169],"significantly":[171],"affect":[172],"performance,":[174],"making":[175],"it":[176],"reliable":[178],"choice":[179],"backend":[182],"program":[183],"extended":[189],"period":[190],"time.":[192]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}