Abstract: Hooking the system services to hide the presence of objects such as processes, files, registry keys, and open ports is the most popular method of rootkits. But a great deal of rootkits detection methods can＇t tell the relationship between the rootkits and

Key words: Rootkits,System service,Behavior,Control-flow graph,Data-flow graph,Call graph