Which detection approach relies on cross-view verification to reveal rootkit activity by comparing different representations of data?

• A. Cross View-Based Detection
• B. Runtime Execution Path Profiling
• C. Alternative Trusted Medium
• D. GMER

Answer: (A)

Cross-view verification checks the same state from multiple representations and looks for mismatches that indicate tampering. In rootkit detection, this means generating different views of the system state—for example, what the disk stores versus what appears in memory or what system utilities report versus the kernel’s own data structures—and then comparing them. If the rootkit hides activity in one view, the other views often expose inconsistencies, revealing the hidden behavior. That focus on contrasting data representations to expose discrepancies is exactly what cross-view-based detection does best.

Other approaches don’t center on comparing multiple representations. Runtime execution path profiling watches how code executes to spot unusual control flows, but it doesn’t inherently rely on cross-view evidence. The idea of an Alternative Trusted Medium isn’t a standard, widely recognized detection method. GMER is a tool that uses various checks to detect rootkits, including hooks and hidden objects, but it’s not defined by cross-view verification itself.