Dubbing their new architecture "HookSafe", the software platform relocates kernel hooks inside guest operating systems to a more secure space in memory, which they claim is able to prevent the majority of rootkit software from hiding. Running it on a live platform, they demonstrated HookSafe preventing nine different locally-executed rootkits from infecting an Ubuntu 8.04 server. What's more, they claim that the added system load in doing this resulted in only a minor drop in performance -- as little as 6%.
The software is aimed at Linux. Rather than attempting to re-write the basic nature of the Linux kernel, they instead focused on making existing environments safer. They may be right, seven of the rootkits tested were unable to install at all, and the others were unable to hide. Down the road, this research could lead to workstations and servers all over the world being much more resistant to rootkits.