基于LKM的Linux安全检测器的设计与实现  

Design and Implementation of Linux’s Security Monitor Based on LKM

作　　者：袁源[1] 罗红[1] 戴冠中[1] 吕鹏[1] 

机构地区：[1]西北工业大学自动化学院,陕西西安710072

出　　处：《计算机应用研究》2005年第7期131-133,共3页Application Research of Computers

基　　金：航空科学基金资助项目(01F53031);教育部博士点基金资助项目(20020699026)

摘　　要：分析两个Linux后门工具的实现机制,指出它们的原理及其危害;针对Linux操作系统的特点提出两种保护Linux内核的方法,即单模块内核方式和带安全检测的LKM方式。给出了基于LKM的Linux安全检测器的实现方法,实验表明,该安全检测器能有效地记录LKM后门工具以及病毒对系统的攻击和非法访问,能够帮助系统管理员维护Linux操作系统的安全。This paper analyses the mechanism of two Linux’s backdoor tools and points out their principles and harms. According to the characteristics of Linux, two kinds of protecting Linux’s kernel methods are proposed in this paper, that is , single kernel module mode and LKM with security check mode. The realization method of Linux monitor based on LKM is also presented in this paper. The experimentations show that this monitor can efficiently record the attacks and illegal access from LKM backdoors and viruses,can help the system administrator to safeguard the security of Linux.

关 键 词：LINUX 可装载内核模块 后门工具 系统调用 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]