基于VMM的Rootkit及其检测技术研究  

Research on VMM-based Rootkit and its Detection Technology

作　　者：周天阳[1] 朱俊虎[1] 王清贤[1] 

机构地区：[1]解放军信息工程大学信息工程学院,郑州450002

出　　处：《计算机科学》2011年第12期77-81,共5页Computer Science

基　　金：国家高技术研究发展计划(863计划)基金资助项目(2008AA10Z419);河南省基础与前沿技术研究计划(082300410150)资助

摘　　要：借助虚拟化技术,Rootkit隐藏能力得到极大提升,基于VMM的Rootkit的研究成为主机安全领域的热点。总结了传统Rootkit的隐藏方法和技术瓶颈,介绍了VMM的自身优势和软、硬件实现方法,分析了不同VMM Root-kit的设计原理和运行机制。针对VMM存在性检测的不足,阐述了一种新的VMM恶意性检测思路,同时讨论了VMM Rootkit的演化方向,并从防护的角度提出了一些安全使用虚拟化技术的建议。Leveraging virtualization technology, rootkit has improved its stealth capability greatly. Research on VMM- based rootkit has beeome the focus in computer security field. This paper summarized the traditional hidden methods and the bottleneck of the in-box technology, introduced the advantage of VMM at architecture and the implementation based on software and hardware, and then analyzed the design and operation meehanisms of various VMM Rootkits. In order to resolve the limitation of VMM existence detection, it proposed a new method detecting malieious VMM. In ad- dition, this paper discussed the evolvement of VMM Rootkit, and presented how to apply virtualization techniques safely to defend VMM Rootkit.

关 键 词：ROOTKIT 虚拟机监控器 检测 防护 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]