How can I find, Which part of my system are infected or injected?

[Jason Long]

Hello.
How can I find which part of my system changed by an attacker? For example, An attacker hack my system and inject a code into Kernel or insert a backdoor, How can I understand it?

Tnx.

 

[Darren Hale]

Welcome try these:
https://www.rfxn.com/projects/linux-malware-detect/
http://www.linux.org/threads/malware-and-antivirus-systems-for-linux.4455/

 

[Jason Long]

Thank you.
I know the ClamAV and others but I means is detect it manually. Some tools like DeepFreeze exit for Linux and they Freeze System but Can I protect Kernel and sensitive part of my systems via "fail2ban" , "SElinux" or Others?

 

[JD P]

I'd use my versioned backups to compare changes over time. Backups have thousands of uses and helping solve security issues is in the top 5.

 

[Jason Long]

Can SElinux protect Kernel?

 

[JD P]

Can SElinux protect Kernel?

SElinux is 1 tool to protect the system from user programs.
There exist attacks that need SELinux in order to work.

Security is not a yes/no question.