USB可移动存储设备监控软件研究与实现

针对USB可移动存储设备日益成为越来越多的病毒、木马的主要攻击对象，尤其是窃密木马等会扫描接入系统的USl3可移动存储设备并将机密文件秘密地复制并通过网络发送出去，造成严重的安全隐患的问题，文中在微软文件系统过滤驱动开发模型Sfilter的基础上，设计开发了一款USB可移动存储设备监控软件，通过截获对于USB可移动存储设备内文件操作的IRP（I／ORequestPacket），分析出相应的文件操作类型，对截获到的IRP进行不同的处理，实现了可控的安全进程规则与防拷贝功能，并结合相应的日志显示最终保证了USB可移动存储设备内文件的安全性。经过实验测试，软件桑缔话行币常．能够右效噼榨USB可耨动存储设备内文件的访问和存取等操作。

Research and Implementation on USB Monitor Software for Removable Devices

Aiming at the problem that the USB portable storage devices have been considered as one of the chief attacking targets by an increasing number of computer viruses and Trojans, some of which can even scan for the available USB device, sneakingly copying its se- cre, t documents and then spreading them with network, finally triggering serious security issues, based on Sfilter, the filtering driver proto- type of Microsoft fi｜e system,develop a USB monitor software whose functions by intercepting various IRP （I/O Request Packet） of the USB＇deviee are to work out the corresponding file operation types and take relevant reactions. The system supports custom-made security proeess rules, achieves anti-copying and guarantees the security of the USB device by showing the logs. The experiment shows that the system works well and is able to effectively supervise the accessing to the files in USB device.