一种新的注册表隐藏Rootkit检测方案

doi:10.3969/j.issn.1671-7775.2010.03.018

摘要
图/表
参考文献
相关文章 (0)

全文: PDF (412 KB) HTML (1 KB)
输出: BibTeX | EndNote (RIS)

摘要为了检测通过篡改注册表文件而实现潜行于操作系统的Rootkit,分析了常见的Rootkit注册表隐藏技术以及相应的检测技术,并指出了当前检测技术存在的缺陷.在分析注册表文件的格式以及注册表操作控制流程的基础上,设计并实现了一种新型的注册表隐藏Rootkit检测方案.通过模拟win32系统底层枚举注册表键值的流程,获取真实有效的注册表键值,从而检测出隐藏的Root-kit.同时,在遍历注册表键值时使用了二叉搜索树算法以提高检测效率.试验表明该方法能准确并快速地检测出使用了注册表隐藏技术的Rootkit.

	服务

	把本文推荐给朋友
	加入我的书架
	加入引用管理器
	E-mail Alert
	RSS
	作者相关文章
	张登银
	高德华
	李鹏

关键词 ：病毒 ')" href="#">病毒 , 入侵检测')" href="#">入侵检测, Rootkit ')" href="#"> Rootkit , 注册表')" href="#">注册表

Abstract：In order to detect the Rootkits which hid in a system by tampering registry file,the common hidden technology of Rootkits and corresponding detection methods were analyzed,and the weaknesses of these detection methods were pointed out.Based on the analysis of format of registry files and the flow control for a typical registry operation,a new Rootkit detection method was designed and realized.The process of enumerating the registry keys in win32 system kernel was simulated,and valid keys of registry were obtained.Binary search tree algorithm was used to improve the detection efficiency in ergodic key value of registry.The results of experiments show that this method can detect the Rootkits which hide registry key effectively and quickly.

基金资助:

国家“863”计划项目（2007AA701302 2008AA701202）

引用本文:

张登银, 高德华, 李鹏 . 一种新的注册表隐藏Rootkit检测方案[J]. 江苏大学学报（自然科学版）, 2010, 31(3): 328-323. Zhang Dengyin, Gao Dehua, Li Peng-. 10.3969/j.issn.1671-7775.2010.05.001[J]. Journal of Jiangsu University(Natural Science Eidtion) , 2010, 31(3): 328-323.

链接本文:

http://zzs.ujs.edu.cn/xbzkb/CN/10.3969/j.issn.1671-7775.2010.03.018 或 http://zzs.ujs.edu.cn/xbzkb/CN/Y2010/V31/I3/328