摘要
用挂钩系统服务来实现进程、文件、注册表、端口等对象的隐藏是最常见的rootkits实现方式。然而大量的检测方法并不能将rootkits和其所隐藏的对象对应起来。本文分析了用户层和内核层系统服务rootkits的隐藏行为,建立了6种模型。在检测出系统服务rootkits的基础上,提出了一种分析其二进制执行代码,匹配模型,找出隐藏对象的方法,实现了一个隐藏行为分析原型。实验结果证明这种隐藏行为分析方法能有效分析出隐藏对象。
Hooking the system services to hide the presence of objects such as processes, files, registry keys, and open ports is the most popular method of rootkits. But a great deal of rootkits detection methods can＇t tell the relationship between the rootkits and the hided objects. Analyzing the undetectable behavior of user-mode or kernel-mode rootkits on system services, six hide models are built. We develop a method to reveal the object bided by the rootkits when the rootkits are detected through analyzing the binary code of the rootkits function and matching the hide models. We implement a prototype of the method. The results of experiments on some famous rootkits demonstrate the effectiveness of the model.
出处
《计算机科学》
CSCD
北大核心
2008年第6期103-106,共4页
Computer Science
基金
863项目:分布式可信计算系统研究(2007AA1Z409)
