基于行为特征的BIOS Rootkit检测  

BIOS Rootkit Detection Based on Behavior Characteristics

作　　者：郭致昌[1] 张平[1] 庞建民[1] 郭浩然[1] 崔晨[1] 

机构地区：[1]解放军信息工程大学信息工程学院,郑州450002

出　　处：《计算机工程》2011年第2期251-252,255,共3页Computer Engineering

基　　金：国家"863"计划基金资助项目(2009AA01Z434);河南省重大科技攻关计划基金资助项目(092101210501)

摘　　要：针对BIOS Rootkit难以检测的问题,提出一种基于行为特征的BIOS Rootkit的检测方法。该方法通过研究BIOS Rootkit工作原理和实现技术,对BIOS Rootkit的行为特征进行归纳、定义和形式化描述,在反编译的过程中提取行为,根据提取的行为构成BIOS Rootkit的完整程度进行恶意性判定。实验结果证明,该方法能够有效检测主流的BIOS Rootkit。BIOS Rootkit is difficult to detect. Aiming at the problem, this paper proposes a behavior characteristics-based BIOS Rootkits detection method. By studying the BIOS Rootkits＇ principles and key technologies, this method generalizes, defines and formally describes the behavior characteristics of BIOS Rootkit. Behaviors information is got in decompile phases, and the malicious level is judged according to the rate of a complete BIOS Rootkit lormcd by those behaviors. Experimental results prove that the method is effective to detect BIOS Rootkits.

关 键 词：BIOS安全 逆向工程 恶意代码 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]