I. INTRODUCTION

II. A SURVEY OF EXISTING STEALTH MALWARE  
A. Type 1 Rootkits: Malicious System Files on Disk  
B. Kernel-Mode Hooking  
C. Hybrid Hooking  
D. Type 3 Rootkits: Direct Kernel Object Manipulation  
E. Code Mutation  
F. Anti-Emulation  
G. Targeting Mechanisms  

III. COMPONENT-BASED STEALTH MALWARE COUNTERMEASURES  
A. Detecting Hooks  
B. Cross-View Detection and Specification Based Methods  
C. Invariant Specification  
D. Hardware Solutions  
E. Virtualization Techniques  

IV. PATTERN-BASED STEALTH MALWARE COUNTERMEASURES  
A. Signature Analysis  
B. Behavioral/Heuristic Analysis  
C. Feature Space Models vs. State Space Models  

V. TOWARD ADAPTIVE MODELS FOR STEALTH MALWARE RECOGNITION  
A. Six Flawed Assumptions  
B. An Open Set Recognition Framework  
C. Open World Archetypes for Stealth Malware Intrusion Recognition  

VI. CONCLUSIONS AND OPEN ISSUES