The tool presented below tries to detect from remote if the target machine was compromised with the HACKER Defender rootkit. The tool connect to the remote host, and compares the reply to several known replies. The rootkits that can be detected by the tool are: HACKER Defender v1.0.0 and below.
// chebysheve outlier detection
// this function is used to detect the abnormal value among a set of data
// input:
// delta: a set of data
// flag: discribe which data is already known as outlier
// p: restrict level
// output:
// double[] door : byyond which the data may be considered as a outlier
// door[0]: the upperdoor
// door[1]: the lowerdoor
