  One of the most elusive types of malware in recent times that pose
significant challenges in the computer security system is the kernel-level
rootkits. The kernel-level rootkits can hide its presence and malicious
activities by modifying the kernel control flow, by hooking in the kernel
space, or by manipulating the kernel objects. As kernel-level rootkits change
the kernel, it is difficult for user-level security tools to detect the
kernel-level rootkits. In the past few years, many approaches have been
proposed to detect kernel-level rootkits. It is not much difficult for an
attacker to evade the signature-based kernel-level rootkit detection system by
slightly modifying the existing signature. To detect the evolving kernel-level
rootkits, researchers have proposed and experimented with many detection
systems. In this paper, we survey traditional kernel-level rootkit detection
mechanisms in literature and propose a structured kernel-level rootkit
detection taxonomy. We have discussed the strength and weaknesses or challenges
of each detection approach. The prevention techniques and profiling
kernel-level rootkit behavior affiliated literature are also included in this
survey. The paper ends with future research directions for kernel-level rootkit
detection.
