基于线程调度的进程隐藏检测技术研究  

Research on Thread Dispatch Based Hidden Process Detection Technique

作　　者：梁晓[1] 李毅超[1] 

机构地区：[1]电子科技大学计算机科学与工程学院,成都610054

出　　处：《计算机科学》2006年第10期114-115,118,共3页Computer Science

摘　　要：基于线程调度的进程隐藏检测技术,利用操作系统进程的资源分配和调度机理,通过直接扫描系统内核中的活动线程来逆向检测实际存在的进程列表信息。该方法可以检测出当前常规安全检测工具不能发现的系统恶意程序的入侵行为。和现有的进程隐藏检测方法相比,该检测方式克服了各种缺陷,具有更加彻底可靠的安全机制,可以检测出当前所有类型的进程隐藏。Thread dispatch based hidden processes detection technique makes use of the processes resource assignment and dispatch mechanism in operating system to scan active threads in system kernel for reverse detecting active processes list. This method can detect more Trojan horse＇s intrusions than general security detection software. Comparing with normal hidden process detection techniques, it has gotten over all of the limitations, and found all types of current hidden processes based on more reliable secure mechanism.

关 键 词：特洛伊木马 ROOTKIT 进程隐藏 线程调度 入侵检测 

分 类 号：TP316.7[自动化与计算机技术—计算机软件与理论]