信息网络安全

信息网络安全 ›› 2014, Vol. 15 ›› Issue (11): 52-58.doi: 10.3969/j.issn.1671-1122.2014.11.009

• • 上一篇    

基于Windows API调用机制的Rootkit检测系统的设计与研究

袁宇恒, 黄耿星, 龚征()   

  1. 华南师范大学计算机学院,广东广州 510631
  • 收稿日期:2014-08-28 出版日期:2014-11-01 发布日期:2020-05-18
  • 作者简介:

    作者简介：袁宇恒（1990-）,男,广东,硕士研究生,主要研究方向：密码学与网络安全;黄耿星（1990-）,男,广东,本科,主要研究方向：客户端安全;龚征（1981-),男,江西,副教授,博士,主要研究方向：密码学与网络安全。

  • 基金资助:
    国家自然科学基金[61100201,61300204];广东省自然科学基金[S2012040006711];广东省高等学校优秀青年教师培养计划资助项目[Yq2013051];广州市珠江科技新星专项[2014J2200006]

The Design and Research of Rootkit Detection System Based on Windows API

Yu-heng YUAN, Geng-xing HUANG, Zheng GONG()   

  1. School of Computer Science, South China Normal University, Guangzhou Guangdong 510631,China
  • Received:2014-08-28 Online:2014-11-01 Published:2020-05-18

RichHTML

4

摘要：

从功能上来看,Rootkit是指隐藏进程、网络端口、文件痕迹等的恶意软件,现已被广泛应用在黑客入侵和攻击他人的计算机系统上。许多计算机病毒、间谍软件也都常常使用Rootkit潜伏在操作系统上伺机而动。如何有效地对Rootkit进行检测和防范成为应对木马入侵和僵尸网络的首要解决的关键问题。文章在以往的研究基础上,通过深入探讨Windows底层原理,开发了一个基于Windows API调用机制的Rootkit检测系统。在该系统的帮助下,用户不但可以深入查看操作系统的各类底层信息,还可以很方便地找出隐藏在计算机之中的病毒、木马并进行清理,从而更好地保护操作系统。该系统丰富了现今针对Rootkit检测的研究成果,对后续的研究具有一定的参考价值。

关键词: Rootkit检测, Windows内核, 操作系统

Abstract:

Rootkit is referred to the malicious software that hides the traces of processes, network ports, files, etc. It is now widely used for the hacker intruding and attacking other peoples’ computer systems. Many computer viruses and spywares also use Rootkit to lurk in the operation system and watch for the proper moment for action. How to detect Rootkit efficiently becomes the key problem to counter these kinds of attacks. On the basis of previous works,this paper discusses the underlying principles of Windows, and developes a Rootkit detection system based on the WINDOWS API. With its help, the user can not only discover different kinds of hidden information of the operation system, but also easily find out the virus and Trojan which are running in the computer and clean them up. To a certain extent, this system enriches the research productions on Rootkit detection, and can offer reference for the follow-up studies.

Key words: Rootkit detection, Windows kernel, operating system

中图分类号: