| 永久型Windows Rootkit检测技术 |
| |
| 引用本文： | 王全民,于佳耕,赵彤,韩红英. 永久型Windows Rootkit检测技术[J]. 计算机工程, 2008, 34(18): 70-71 |
| |
| 作者姓名： | 王全民 于佳耕 赵彤 韩红英 |
| |
| 作者单位： | 天津大学计算机学院,天津,300072;北京工业大学计算机学院,北京,100022;北京工业大学计算机学院,北京,100022 |
| |
| 摘 要： | 永久型Rootkit可以长期隐秘在系统中，并隐藏恶意代码，威胁计算机的安全。该文应用cross-view方法构建监控系统，采用文件系统过滤驱动与钩挂系统服务分析系统行为，判定系统是否已被装入永久型Windows Rootkit，并完成对经典Rootkit-hacker defender及它所保护的恶意程序的检测。由于该检测技术使用底层驱动监测，不依赖特征码，因此对内核级和将来出现的Rootkit具有良好的检测 效果。
|
| 关 键 词： | 监控系统 永久型Rootkit cross-view方法 |
| 修稿时间： | |
Detection Technique of Persistent Windows Rootkit |
| |
| WANG Quan-min,Yu Jia-geng,ZHAO Tong,HAN Hong-ying. Detection Technique of Persistent Windows Rootkit[J]. Computer Engineering, 2008, 34(18): 70-71 |
| |
| Authors: | WANG Quan-min Yu Jia-geng ZHAO Tong HAN Hong-ying |
| |
| Affiliation: | (1. College of Computer, Tianjin University, Tianjin 300072;2. College of Computer, Beijing University of Technology, Beijing 100022) |
| |
| Abstract: | Because of permanently storing and hiding intruder's codes, persistent Rootkit becomes a very important issue of computer security.This paper applies the cross-view method to construct the monitor system.It is implemented to decide whether the system is installed persistentwindows Rootkit by analyzing system's behaviors using file system filter driver and hooking system services.The system detectes Rootkit-hackerdefender which is the most classical Rootkit in the real world and some malwares protected by it... |
| |
| Keywords: | monitor system persistent Rootkit cross-view |
| 本文献已被 CNKI 维普 万方数据 等数据库收录！ |
| 点击此处可从《计算机工程》浏览原始摘要信息 |
|
点击此处可从《计算机工程》下载全文 |
