Another Formal Proposal For Stealth

Authors: Adrien Derock, Pascal Veron

Abstract:

Taking into account the link between the efficiency of a detector and the complexity of a stealth mechanism, we propose in this paper a new formalism for stealth using graph theory.

Keywords: Detection, eradication, graph, rootkit, stealth.

Digital Object Identifier (DOI): doi.org/10.5281/zenodo.1334544

References:

[1] L. Adleman, "An abstract theory of computer viruses," in Proceedings on advances in cryptology, Crypto-88. Springer-Verlag, 1990, pp. 354- 374.
[2] Z. Zuo and M.-t. Zhou, "Some further theoretical results about computer viruses," The Computer Journal, vol. 47, no. 6, pp. 627-633, 2004.
[3] E. Filiol, Techniques virales avanc'ees. Springer Verlag France, the english version is pending (due January 2009) under the reference Advanced Computer Viruses techniques, IRIS International Series, Springer Verlag France, 2007.
[4] ÔÇöÔÇö, "Formal model proposal for (malware) program stealth," in Proceedings of Virus Bulletin Conference, VB2007, 2007.
[5] F. Cohen, "Computer viruses: Theory and experiments," Computers & Security, vol. 6, no. 1, pp. 22-35, 1987.
[6] K. Godel, "¨Uber formal unenscheidbare s¨atze der principia mathematica und verwandter systeme," Monatshefte fr Math. Phys, vol. 37, 1931.
[7] E. Filiol, Computer Viruses : from theory to applications. IRIS International Series, 2nd, Springer Verlag France, 2003.
[8] C. Cachin, "An information-theoretic model for steganography," Inf. Comput., vol. 192, no. 1, pp. 41-56, Mar. 2004.
[9] ÔÇöÔÇö, "Digital steganography," Encyclopedia of Cryptography and Security, Feb. 2005.
[10] M. Myers and S. Youndt, "An introduction to hardware-assisted virtual machine (hvm) rootkits," Aug. 2007.
[Online]. Available: http://crucialsecurity.com/
[11] C. Berge, Th'eorie des graphes et ses applications. Dunod, 1958.
[12] A. Bunten, "Unix and linux based rootkits techniques and countermeasures," Apr. 2004.
[13] K. kasslin, M. Stlahberg, S. Larvala, and A. Tikkanen, "Hide-n seek revisited - full stealth is back," 2005.
[14] E. Filiol, "Les virus du futur(s)," Laboratoire de virologie et de cryptologie, ESAT, Rennes, France, Oct. 2007.