一种融合用户级和内核级拦截的主动防御方案

通过对Windows环境下程序机理的分析研究, 探索采用用户级别拦截、内核级别拦截相结合的主动防御技术实现对恶意入侵行为自动精确检测和自动识别, 保障系统和网络的安全。实验结果表明, 该技术对于未知恶意入侵及其变种的检测能力均优于单一方法和其他传统检测方法。

Active defense scheme of fusion of user-level and kernel level interception

Based on the Windows environment procedures mechanism analysis, this paper explored the use of user level intercept, the kernel level intercept which combined with active defense technology of malicious code behavior accurately automatic detection and automatic identification, and proved security system and security of network. The experimental results show that the technology for the unknown malicious code and its variants of the detection ability is better than single method and other traditional methods of detection.