Windows下基于交叉视图的Rootkit进程隐藏检测技术

对现有的Windows Rootkit进程隐藏技术进行了研究,提出了基于交叉视图的Rootkit进程隐藏检测技术.该技术通过比较从操作系统的高层和底层获取到的进程列表来检测被Rootkit所隐藏的进程,其中,底层进程列表是通过搜索内存中的内核对象来获得的.实验表明,该技术具有较好的检测效果.

Hidden Process Detection Technique of Rootkit Based on Cross-View in Windows

This paper studied the existing hidden process techniques of rootkit in Windows,and then proposed a hidden process detection technique of rootkit based on cross-view.This technique detects hidden process by comparing the process lists attained from operating system high-level and low-level respectively.In particular,the low-level process list is attained by searching the kernel objects in memory.Experiments show that this technique owns satisfied detection effect.