| 基于协同特征的BIOS Rootkit检测技术 |
| |
| 引用本文： | 邓立丰,王宏霞.基于协同特征的BIOS Rootkit检测技术[J].计算机工程,2010,36(15):134-136,139. |
| |
| 作者姓名： | 邓立丰 王宏霞 |
| |
| 作者单位： | 1. 西南交通大学信息科学与技术学院,成都,630031
2. 西南交通大学信息安全与国家计算网格实验室,成都,630031 |
| |
| 基金项目： | 四川省青年科技基金资助项目 |
| |
| 摘 要： | 对木马模型框架的理论及其协同隐藏模型进行研究和分析，给出BIOS Rootkit协同隐藏模型的具体形式化描述，提出一种在Windows环境下基于协同特征的BIOS Rootkit检测技术。针对现有BIOS Rootkit检测技术存在能查但不能正常恢复的问题，采用搜索特征码并动态恢复的技术解决。实验结果表明，该检测技术具有良好的可靠性、检测效率和完整性。
|
| 关 键 词： | 协同隐藏 BIOS Rootkit技术 检测 |
BIOS Rootkit Detection Technology Based on Cooperation Feature |
| |
| DENG Li-feng,WANG Hong-xia.BIOS Rootkit Detection Technology Based on Cooperation Feature[J].Computer Engineering,2010,36(15):134-136,139. |
| |
| Authors: | DENG Li-feng WANG Hong-xia |
| |
| Affiliation: | (1. School of Information Science and Technology, Southwest Jiaotong University, Chengdu 630031; 2. State Laboratory for Information Security and Computing Grid, Southwest Jiaotong University, Chengdu 630031) |
| |
| Abstract: | To research and analyze the theory of framework for modeling trojans and trojans model about cooperative concealment,this paper gives BIOS Rootkit’s formal model about cooperative and presents a BIOS Rootkit detection technology based on the character of cooperation in Windows environment.Current detection technology of BIOS Rootkit can detect but lacks the function of resuming,so the method uses characteristic of codes searching and dynamic resuming to solving it.Experimental results show that this is a detection method of higher reliability,efficiency and integrity. |
| |
| Keywords: | cooperative concealment BIOS Rootkit technology detection |
| 本文献已被 维普 万方数据 等数据库收录！ |
| 点击此处可从《计算机工程》浏览原始摘要信息 |
|
点击此处可从《计算机工程》下载全文 |
|
