基于线程管理-端口截听的木马检测系统的设计  

Design of Trojan Horse Detecting System-Based on Thread Management and Port Intercepting

作　　者：李蓉[1] 周维柏[1] 

机构地区：[1]华南师范大学增城学院,广东广州511363

出　　处：《甘肃联合大学学报（自然科学版）》2009年第1期76-78,82,共4页Journal of Gansu Lianhe University :Natural Sciences

基　　金：广东省本科高等教育教学改革项目(BKJG200765)

摘　　要：随着互联网越来越生活化,层出不穷的木马已是网络安全的主要威胁,其隐蔽性很强,使一般检测工具难以检测.本系统通过直接扫描系统内核中的活动线程以及截拦活动线程的网络数据流量来进行木马的检测.可以检测出当前所有类型的进程隐藏木马.With internet widely used in our daily life, the Trojan horses are emerging one after another and have become the main threat of network security. The deep hiding of the Trojan horses makes it difficult to detect them with ordinary tools. But this system discussed here can detect the Trojan horses by means of directly scanning active threads in system kernel and intercepting the network data flow of the active threads to find all types of current hidden processes.

关 键 词：线程调度 进程隐藏 端口截听 木马 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]