Which detection technique compares runtime execution paths of all system processes and executable files before and after rootkit infection?

Which detection technique compares runtime execution paths of all system processes and executable files before and after rootkit infection?

• A. Heuristic/Behavior-Based Detection
• B. Runtime Execution Path Profiling
• C. Cross View-Based Detection
• D. Anti-Rootkits

Answer: (A)

Detecting rootkits by monitoring how code actually runs and spotting deviations from a trusted baseline is a behavior-based approach. By capturing the runtime execution paths of all system processes and executables, you establish a baseline before any infection. After the rootkit appears, you re-check and compare the current paths to the baseline to identify anomalies—unexpected sequences, hidden processes, or altered system calls that suggest tampering. This focus on how programs execute, rather than on known signatures, makes it effective against rootkits that try to conceal themselves by changing control flow or hooking legitimate routines. The idea is to detect abnormal behavior, not just known malware patterns, which is why heuristic/behavior-based detection is the best fit here.

Detecting rootkits by monitoring how code actually runs and spotting deviations from a trusted baseline is a behavior-based approach. By capturing the runtime execution paths of all system processes and executables, you establish a baseline before any infection. After the rootkit appears, you re-check and compare the current paths to the baseline to identify anomalies—unexpected sequences, hidden processes, or altered system calls that suggest tampering. This focus on how programs execute, rather than on known signatures, makes it effective against rootkits that try to conceal themselves by changing control flow or hooking legitimate routines. The idea is to detect abnormal behavior, not just known malware patterns, which is why heuristic/behavior-based detection is the best fit here.