|
|
|
| 10.3969/j.issn.1671-7775.2010.05.001 |
| College of Computer,Nanjing University of Posts and Telecommunications,Nanjing,Jiangsu 210003,China） |
|
|
|
|
Abstract In order to detect the Rootkits which hid in a system by tampering registry file,the common hidden technology of Rootkits and corresponding detection methods were analyzed,and the weaknesses of these detection methods were pointed out.Based on the analysis of format of registry files and the flow control for a typical registry operation,a new Rootkit detection method was designed and realized.The process of enumerating the registry keys in win32 system kernel was simulated,and valid keys of registry were obtained.Binary search tree algorithm was used to improve the detection efficiency in ergodic key value of registry.The results of experiments show that this method can detect the Rootkits which hide registry key effectively and quickly.
|
|
|
|
|
|
|
|
|
2010, Vol. 31 
