基于NTFS磁盘解析的Rootkit检测技术  

Rootkit Detection Technique Based on NTFS Disk Parse

作　　者：王鼎[1] 张小松[1] 龙小书[1] 

机构地区：[1]电子科技大学计算机科学与工程学院,四川成都611731

出　　处：《信息安全与通信保密》2009年第8期200-202,205,共4页Information Security and Communications Privacy

基　　金：2009年保密通信国防科技重点实验室基金资助项目（9140C1104020903）.

摘　　要：木马程序尤其是Rootkit的安全威胁越来越大，如何消除此类威胁成为当今安全研究的重点之一。丈中引入了交叉检测思想，采用了NTFS文件系统磁盘解析技术检测隐藏文件，从而有助于Rootkit类木马程序的检测。在此基础上，给出了完整的设计方案及评估方法，对于加固系统安全具有重要意义。The threat of Trojan horse, especially the Rootkit is becoming even more serious nowadays, how to defeat them has become an important issue in computer security. This paper proposes cross-view detection methods and the technique based on NTFS disk parse is introduced to detect hidden files and to further detect Rootkit. Based on this idea, the perfect design and evaluation method is put forward, which is of great importance in the enhancement of system security.

关 键 词：木马(Rootkit类)检测 交叉检测 隐藏文件检测 NTFS磁盘解析 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]