# Machine Learning and Deep Learning Based Model for the Detection of Rootkits Using Memory Analysis
## 4 Methodology
### Data Acquisition
#### 4.1.3 Feature Extraction and Memory Analysis  
The Volatility v3.2 tool, installed in a Kali Linux environment, was employed for memory analysis. The memory dumps were transferred to this virtual machine for analysis. Features such as processes, DLLs, handles, modules, injected codes, networks, services, callbacks, and privileges were investigated using specific Volatility commands. The obtained information is categorized into sub-features for further analysis. Table 2 shows the features and sub-features that make up the final dataset. * _Processes:_ This involves identifying and examining the various processes running within the memory and their attributes. By analyzing the processes, it is possible to detect any suspicious or malicious programs that may be present. Rootkits often disguise themselves as legitimate processes, making the analysis of processes crucial in identifying potential threats. * _Dynamic Link Libraries (DLLs):_ DLLs are modules that contain code and data that multiple programs can use simultaneously at run time. In memory analysis, the DLLs loaded by processes are analyzed to detect any anomalous or malicious DLLs. This helps in identifying rootkit activities that involve injecting malicious code into legitimate processes through DLLs. * _Handles:_ Handles provide a way to access system resources, such as files, devices, and synchronization objects. During memory analysis, the handles utilized by processes are examined. This analysis can reveal any suspicious or unauthorized access to system resources, which can indicate the presence of rootkits. * _Modules:_ Modules refer to the executable code and associated data loaded into the memory. In memory analysis of modules, the focus is on their characteristics to identify any abnormal or unauthorized modules. Rootkits often modify modules to gain control over system processes and execute malicious activities. By analyzing the modules, potential rootkit-related modifications can be detected. * _Injected Codes:_ Injected code refers to the malicious code injected into a legitimate process's memory space. During memory analysis, this involves searching for any signs of injected code, such as unexpected modifications or additional code segments. Detecting injected code is crucial in identifying the presence of rootkits, as they often use this technique to hide their activities and evade detection. * _Networks:_ The analysis of network-related information within memory dumps helps in identifying any suspicious network connections or communications. This involves examining network-related data, such as open ports, established connections, and communication protocols. Detecting unusual or unauthorized network activities can provide insights into the presence of rootkits and their communication with external entities. * _Services:_ Services are background processes that run independently of user interactions. In memory analysis, the services running within the memory are examined to identify if they are suspicious or unauthorized. Rootkits can manipulate services to gain persistence or execute malicious activities. Analyzing services helps in detecting such manipulations and identifying potential rootkit activities. * _Callbacks_: Callbacks are functions that are registered by processes to be executed when certain events occur. During memory analysis, registered callbacks are inspected to identify any anomalies or unauthorized changes. Rootkits can tamper with callbacks to gain control over system events and execute malicious actions. Analyzing callbacks helps in detecting such modifications and potential rootkit presence. * _Privileges_: Privileges refer to the rights and permissions granted to processes to perform specific operations. In memory analysis, the privileges assigned to processes are examined to identify any unauthorized or elevated privileges. Rootkits often elevate privileges to gain higher system access and execute malicious activities.