自动探测和保护确保内核完整性

内核rookits攻击对内核完整性构成致命威胁,因此对内核rootkits探测和防护确保内核完整性是当前研究的热点,然而现有的研究总存在不足:要么侧重内核rootkits防护,要么侧重内核rootkits探测,并未将两者相结合确保内核完整性。鉴于此,本文将探测和保护相结合形成一个自动联动机制,从而构成了基于探测保护的一体化系统ADPos来确保内核完整性。实验表明ADPos系统既能自动全面有效地探测与防护,而且又不牺牲系统性能为代价,并且兼容多种OS系统、同时防零日攻击。

Automatic Detection and Protection System to Ensure Kernel Integrity

Kernel-level rootkits pose a fatal threat to kernel integrity, so kernel-level rootkits detection and protection has become a hot topic. However, there are some drawbacks in these existing efforts: either focusing on rootkits protection, or focusing on rootkits detection, without the combination of both to ensure kernel integrity. In view of this situation, this paper designs a complete automatic interactive mechanism based on the detection and protection of kernel-level rootkits, thus forming an integrated detection and protection system (ADPos) to guarantee kernel integrity. The experiments show that the ADPos system can not only automatically detect and protect kernel integrity, but also does not sacrifice the system performance for the price. Moreover, the system is compatible with a variety of OS systems and against zero-day attacks.