{'fraction_non_alphanumeric': 0.015167930660888408, 'fraction_numerical': 0.0, 'mean_word_length': 5.285714285714286, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Paladin : Automated Detection and Containment of Rootkit Attacks

Rootkit attacks are a serious threat to computer systems. Packaged with other malware like worms, viruses and spyware, rootkits pose a more potent threat than ever before by allowing the malware to evade detection. In the absence of appropriate tools to counter such attacks, compromised machines stay undetected for extended periods of time. Leveraging virtual machine technology, we propose a solution for real-time automated detection and containment of rootkit attacks. We have developed a prototype for a Linux virtual machine using VMware Workstation to illustrate the solution. Our analysis and experimental results indicate that we can successfully detect and contain the effects of almost all rootkits found for Linux today. We also demonstrate with an example, how this approach is particularly effective against malware that use rootkits to hide.