基于Windows内核进程监控机制的研究与实现

互联网技术的不断发展对信息系统的安全提出了更高的要求,需要对系统提供更多方面的防护机制,而系统进程则是其中防范的一个方面。本文在Windows内核驱动程序理解的基础上,对系统进程监控技术进行了深入研究,采用事件触发的机制和技术,实现了对系统进程实时可靠的监控。

Process Monitoring and Implementation Mechanism on Windows kernel

With the continuous development of Intemet technology, information systems security put forward higher requirements ;The need for the system to provide more aspects of defense mechanisms, and the system processes is one of the aspects of prevention ;Based on the understanding of the basis of the above Windows kernel drivers, and system process monitoring technology for in-depth research,This article using the event trigger mechanisms and techniques to achieve a reliable real-time system monitoring process.