摘要
Bootkit这种新型恶意代码通过感染磁盘的主引导记录(MBR)或卷引导记录(VBR)来获取执行权,从而将加载时间大大提前以使常规基于动态行为分析的安全软件都不能对其进行有效检测[1]。针对Bootkit检测这一难题提出一种新型静态检测方法,设计实现相关的MBR匹配算法,并针对国内外知名的Bootkit恶意代码样本进行实验。实验结果显示此方法可以有效检测出当今主流的Bootkit恶意代码,进而证明了静态检测思路的可行性。
Bootkit,a novel malicious code,grabs the right of execution by infecting MBR or VBR so that greatly advances the loading time thus disables the effective detection on it by the conventional security software based on dynamic behaviour analysis[1].We propose a novel static detection method in this paper aiming at such a difficulty of Bootkit detection,design and implement correlated MBR matching algo-rithm.Moreover,the experiment is carried out against the Bootkit malicious code sample well-known at home and abroad.Experimental re-sults show that this method can effectively detect today’s mainstream Bootkit malicious codes,and further proves the feasibility of static detec-tion idea.
出处
《计算机应用与软件》
CSCD
2015年第6期52-56,共5页
Computer Applications and Software
基金
国家自然科学基金项目(61332010)
