Windows下基于主机的访问控制研究与实现

针对目前的主机安全现状,提出了一种称之为WHIPS(Windows下的主机入侵防御系统)的主机访问控制系统,它能够对操作系统安全起至关重要作用的系统调用进行控制。WHIPS是作为一个内核驱动而实现的,也称之为内核模块,它完全使用的是Windows内核的未文档化结构,不要求对内核数据结构和算法进行修改。WHIPS对应用程序进程是完全透明的,应用程序进程的源代码不用进行任何修改和重新进行编译就可以继续正确工作。

Reserch And Implementation Of Host Access Control For Windows

Presently, aiming at the host security, The paper propose an access control system based on host. called WHIPS that controls the invocation of all the system calls critical for the security of Windows OS. WHIPS is implemented as a kernel driver, also called kernel module. using undocumented structures of the Windows kernel, where it is integrate without requiring changes in the kernel data structures and algorithms. WHIPS is also transparent to the application processes that continue to work correctly with no need of source code change or recompilation.