windows系統(tǒng)內(nèi)核rootkit的檢測(cè)技術(shù)研究

1、華中科技大學(xué)碩士學(xué)位論文Windows系統(tǒng)內(nèi)核Rootkit的檢測(cè)技術(shù)研究姓名：陳發(fā)貴申請(qǐng)學(xué)位級(jí)別：碩士專業(yè)：信息安全指導(dǎo)教師：彭冰20110119華中科技大學(xué)碩士學(xué)位論文IIAbstractWithfastdevelopmentofcomputertechnologytherapidprevalenceoftheIntercomputersystemsareconfrontedwithmemedamagesfrommalwaressu

2、chasvirustrojanwmatechnologycalledRootkitareusedbothbymalwaresecuritysoftwarewhichmakestheconflictbetweenthemspilloverintothekernelofWindowssystem.ItisapracticablesolutionagainstkernelRootkittochecktheintegrityofkernelfu

3、nctiontheintegrityoffunctionaddresstablesuchassystemservicedetableinterruptdetable.Butitisverydiffculttolocatewhichfunctionthekernelexecutionisredirectedto.Besidestherearesomanytruepositivesfalsenegativesusingthismethodw

4、ichmakescommonusersconfused.SomeundocumentedkerneldatastrucurescanbeusedtodetectkernelRootkitswichalsocanbeusedbykernelRootkittobypassthesedetectmethodsbasedonthesestructures.BasedontheacteristicsofWindowssystemkernelRoo

5、tkitanalysisofdetectmethodagainstRootkitnowavailablecombinedwiththeresearchonWRKsourcecodeRootkitsampleswithalargenumbernewdetectmethodsagainstRootkitbasedinlinehookoutlinehookdirectkernelobjectmanipulationweredeliveredw

6、hichwereimplementedinadetectsofaware.anadvancedpatternmatchingalgithmbasedonBMalgithmisusedtoenhancetheefficiencyofRootkitdetection.ThetestresultagainstseveralWindowsRootkitsamplesprovesthatnewdetectmethodsdeliveredinthi

7、spaperhaveadvantagesinaccuracystabilityonthedetectofRootkitbothbasedonkernelhookdirectkernelobjectmanipulationcomparedtothetestresultfromotherdetecttoolonWindowsplatfm.KeyWds:SystemKernelKernelHookDirectKernelManufacture