基于Hook的程序异常行为检测系统设计与实现  

Design and implementation of program behavior anomaly detection system based on system service hook

作　　者：郝东白[1] 郭林[1] 黄皓[1] 

机构地区：[1]南京大学计算机科学与技术系

出　　处：《计算机工程与设计》2007年第18期4373-4376,共4页Computer Engineering and Design

基　　金：江苏省高技术研究计划基金项目(BG2004030)。

摘　　要：从程序访问的资源入手,从中重点选取了注册表、文件以及创建其它进程这些资源的操作为主要监控点,实时检测进程操作资源的行为,并进行关联分析,给出了一种基于系统服务Hook的程序异常行为检测系统。重点介绍了Hook相关技术和该系统的设计结构与实现要点。最后,通过实验验证了该系统的可行性和有效性。This paper started with monitoring system resource of program access. Registry and file and process resource creation are fo-cused on and associated to detect program behavior anomaly at runtime, a program behavior anomaly detection system is designed and implemented based on operating system service Hook some key techniques of Hook are introduced as well as the design structure and im- plementation points of this system. At last, the experimental result validated the feasibility and availability of this system.

关 键 词：资源 进程 钩子 系统服务 监控 关联 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]