基于硬件虚拟化技术的隐藏进程检测技术*

随着越来越多的PC用户习惯于从互联网上下载和执行各类软件，潜在的自隐藏恶意代码已成为亟待解决的安全问题，而进程隐藏是这类恶意代码最常用也是最基本的规避检测的自隐藏技术。针对这个问题，提出了一种新的基于硬件虚拟化技术的隐藏进程检测技术——Libra。Libra通过构造一个轻量级的虚拟机监视器（libra virtual machine monitor,LibraVMM）实现了从虚拟层隐式获取真实进程列表（true process list， TPL）的新技术。与已有的基于虚拟机技术的解决方案相比，Libra

Detecting hidden process with hardware assisted virtual machine monitor

With more and more PC users were accustomed to download and execute programs from Internet,stealth malware had become a major threat to the PC computers.Process hiding was a powerful stealth technique commonly used by stealth malware to evade detection by computer users and anti-malware scanners.This paper proposed a new approach called Libra for detect hidden processes implicitly.Libra implemented a novel lightweight hardware-assisted VMM to obtain the true process list(TPL) from deep within the system.Compared to existing VMM-based approaches,Libra provides two unique advantages: dynamic OS migration and implicit introspection of TPL.The functionality evaluation shows the completeness and effectiveness of Libra.