Метод та засіб виявлення прихованих процесів в операційній системі WINDOWS

Abstract

The paper describes the methodology and tools for detecting hidden processes in an operating system. The proposed software tool provides detection of hidden processes by directly reading data from physical memory, avoiding dependence on standard API calls that can be compromised by rootkits. Based on the analysis of existing methods, their limitations were identified, including the use of only user mode or reliance on standard kernel mechanisms, which does not provide reliable monitoring in case of manipulation. As a result, we developed a software architecture that includes a modular approach, algorithms for in-depth analysis of system structures, and cross-checking data from various sources. The developed approach allows detecting hidden processes even when using modern methods of masking techniques. The conducted testing has confirmed the effectiveness of the proposed tool, demonstrating its superiority over analogues in the face of real threats.