一种基于交叉视图的Windows Rootkit检测方法  

Windows Rootkit Detection Method Based on Cross-view

作　　者：白光冬[1] 郭耀[1] 陈向群[1] 

机构地区：[1]北京大学信息科学技术学院软件研究所高可信软件技术教育部重点实验室,北京100871

出　　处：《计算机科学》2009年第8期133-137,共5页Computer Science

基　　金：国家科技支撑计划(No.2006BAH02A02);国家高技术研究发展计划(863)(No.2006AA01Z175;2006AA01Z189;2007AA01Z462;2007AA010304;2008AA01Z133)资助

摘　　要：Rootkit被病毒、木马等恶意软件用来隐藏其在被入侵系统上的踪迹,使得它们能够在系统中潜伏较长时间,它的存在给系统及其使用者带来较大的安全隐患。首先对Windows rootkit进行了研究,以此为基础,从rootkit的行为入手,提出了基于进程检测进行rootkit检测的机制,并设计了一种基于交叉视图的Windows rootkit检测方法。这种方法通过比较从系统高层和底层获得的进程列表,从中检测出被rootkit隐藏的进程,其中,系统底层的进程列表通过在Windows内核中查找内核对象的方法获得。最后,利用这种方法实现了一个Windows rootkit检测工具VI-TAL,并选用若干有代表性的rootkit进行实验,通过和其他工具的对比,验证了这种方法具有较强的检测功能。Rootkits are often used by attackers to hide their trails in an infected system, so attackers can lurk in an invaded system for a longer time. Rootkits have become new threats to the security of OS. This paper first presented a summary on rootkit and rootkit detection technologies on Windows. Built on the existing techniques, this paper proposed a new rootkit detection method to detect rootkits based on hidden processes. We designed a detection method based on cross-view,which detects hidden process by comparing process lists attained from OS high-level and low-level respectively. The low-level process list was attained by scanning memory to find kernel object in Windows kernel, which the high-level list is attained using Windows APIs. We implemented a Windows rootkit detecting tool named VITAL to implement the proposed method and used some representative rootkits in experiments to verify the effectiveness of the proposed method.

关 键 词：ROOTKIT ROOTKIT检测 隐藏进程 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]