一种基于交叉视图的Windows Rootkit检测方法

针对rootkit采用隐藏注册表达到隐藏自身的目的,从rootkit的自启动行为入手,提出了依据注册表隐藏信息检测rootkit的机制,并设计了一种基于交叉视图的Windows rootkit检测方法。这种方法通过比较从内核态和用户态枚举的注册表信息,从中检测出被rootkit隐藏的注册表项目,继而检测出rootkit。最后,通过一个代表性的实例验证了这种方法具有较好的检测效果。

A Windows Rootkit detection method based on cross-view

Aimed at the problem of rootkit hiding itself by hiding registry information,from the auto-start behavior of rootkit,this paper presented a rootkit detection mechanism based on the hidden registry information,and designed a Windows rootkit detection method based on cross-view.This method by comparing from the kernel mode and user mode enumeration of the registry information found the registry hidden items by rootkit,and then detected the rootkit.Finally,a representative example shows this method has good detection.