摘要
针对恶意代码普遍使用Rootkit技术来隐藏自身进程这一特点,提出了基于内存扫描的隐藏进程检测方法。该方法通过对系统高端虚拟内存的扫描,判断其中存在的Windows内核对象的类型,得到可信的系统进程信息,从而实现对隐藏进程的检测。同时,该检测方法可以实现对其他类型的Windows内核对象的扫描,具有一定的扩展性。
Malicious code commonly uses Rootkit technology to hide its own process, in order to detect malicious code. This article proposed a hidden process detection method based on scanning the memory. The authors scanned the system highend virtual memory, estimated the Windows kernel object type and got the trustworthy system process information, thus achieving the hidden process detection. At the same way, this detection method could be used on other types of Windows kernel obiect scanning with a certain extensibihty.
出处
《计算机应用》
CSCD
北大核心
2009年第B06期89-91,共3页
journal of Computer Applications
