# Machine Learning and Deep Learning Based Model for the Detection of Rootkits Using Memory Analysis
## 4 Methodology
### Model Evaluation
Moreover, we have calculated the execution time, which has not been reported in any other study on rootkit detection. The fastest time is reported by k-NN and the slowest by the DL model LSTM. ## 6 Conclusions and Future Work

The insidious nature of rootkits poses a significant threat to system security and data integrity. The existing approaches for rootkit detection have limitations, and there is a need for an efficient and automated mechanism to identify these malicious programs. In this study, the potential approach for rootkit detection using memory analysis and ML/DL algorithms was explored. The research methodology involved data acquisition, data pre-processing, model creation, and model evaluation. Memory dumps were captured using Dumpit.exe and then analyzed using volatility. Relevant features were extracted, collected, pre-processed, and compiled into a dataset that was subsequently used to train different ML and DL models. The results demonstrated the efficiency of the proposed approach in accurately detecting rootkits. SVM emerged as the most effective model, achieving the highest accuracy \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Ref.** & **Approach** & **Data Source** & **Benign** & **Rootkit** \\ \hline
[25] & Dynamic & VirusTotal & 24,000 & 4500 \\
[19] & Dynamic & Rootkit.com & 473 & 418 \\  & & VirusShare & & \\  & & VX Heaven & & \\
[26] & Dynamic & \(\times\) & 1300 & 700 \\
[18] & Memory Forensics & MalShare & 2600 & 10,500 \\  & & VirusShare & & \\ Our Approach & Memory Analysis & VirusTotal & 400 & 400 \\  & & VirusShare & & \\  & & VX Heaven & & \\ \hline \hline \end{tabular} \(\times\) = Not applicable.

\end{table} 
Table 4: Comparison of Approaches and Data Sources. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Ref.**} & \multicolumn{4}{c}{**ML Algorithms**} & \multicolumn{4}{c}{**DL Algorithms**} & \multirow{2}{*}{**Execution Time**} \\ \cline{2-2} \cline{4-9}  & **SVM** & **DT** & **k-NN** & **RF** & **NB** & **FNN** & **LSTM** \\ \hline
[25] & 99.9 & 83.71 & \(\times\) & \(\times\) & 75.35 & \(\times\) & \(\times\) & \(\times\) \\
[19] & \(\times\) & 95.11 & 91.85 & 96.74 & \(\times\) & \(\times\) & \(\times\) & \(\times\) \\
[26] & \(\times\) & \(\times\) & \(\times\) & \(\times\) & \(\times\) & 67.7 & \(\times\) & \(\times\) \\
[18] & 94.09 & 96.5 & \(\times\) & \(\times\) & \(\times\) & \(\times\) & \(\times\) & \(\times\) \\ Our Approach & 96.2 & 95 & 92.8 & 95.5 & \(\times\) & \(\times\) & 85.8 & ✓ \\ \hline \hline \end{tabular} \(\text{SVM}=\text{Support Vector Machine}\), DT = Decision Tree, k-NN = K nearest neighbor, RF = Random Forest, NB = Naive Bayes, FNN = Forward Neural Networks, LSTM = Long and Short Term Memory, \(\times\) = Not applicable, ✓ = Performed the Metric.

\end{table} 
Table 5: Comparison of Results (Accuracy and Execution Time). rate of 96.2%. K-NN was the fastest model, with a minimum execution time of 0.03 s. Our study is also the first to report the execution time of rootkit detection models. Furthermore, our DL model has almost 18% higher accuracy than the accuracy of the DL model reported in the existing literature. The findings of this research contribute to the field of rootkit detection by showcasing the potential of memory analysis combined with ML and DL algorithms. By leveraging memory analysis, the proposed approach can detect rootkits that may go undetected by traditional detection tools. The incorporation of ML and DL algorithms further enhances the accuracy and efficiency of rootkit detection. This research opens avenues for further exploration and improvement in rootkit detection techniques. Future work can focus on refining the models, exploring additional features, expanding the dataset to enhance the overall performance of the detection system, the family classification of rootkits, and reducing the time of memory analysis.