显示器电磁木马的Soft-TEMPEST技术研究  

Research on Soft-TEMPEST technology for monitor electromagnetic trojans

作　　者：陈荣茂[1] 任江春[1] 龚正虎[1] 

机构地区：[1]国防科学技术大学计算机学院,长沙410073

出　　处：《计算机工程与应用》2012年第27期63-68,共6页Computer Engineering and Applications

基　　金：国家自然科学基金(No.60903204)

摘　　要：显示器电磁木马是通过控制计算机屏幕电磁辐射达到窃取信息目的的一种新型木马。当前的主流防护思想是用软件防护代替较为成熟但造价昂贵的硬件防护机制,然而目前软防护思想大多侧重于理论方法的探索,在实现机制上相对比较复杂。针对显示器电磁木马的工作特点提出了Soft-TEMPEST防护机制,设计了显示器电磁木马的ADFA(API Detection and Frequency Analysis)检测方法。该方法通过API函数序列的周期性挖掘分析,结合对屏幕像素信息的傅里叶变换及频谱分析,达到检测出木马进程的目的。测试结果表明,该方法能够成功检测出多种显示器电磁木马,而且原理简单,方便投入使用。Display electromagnetic trojan is a new type of trojans that steal information through the control of com- puter screen electromagnetic radiation. The mainstream protection idea is that software protections substitute hard- ware protections mechanism which is more mature, but high cost. However, the current soft protections mostly come from the perspective of theoretical methods, which results in a relative complex implementation. This paper propos- es a mechanism of Soft-TEMPEST against monitor electromagnetic trojans and designs a method ADFA （APIs De- tection and Frequency Analysis）. The ADFA detects monitor electromagnetic trojans by cyclical mining API func- tion sequences with Fourier transform of screen pixel information and spectrum analysis. The test results show that the method can successfully detect many types of monitor electromagnetic trojans. What is more, it is simple and can be easily put into use.

关 键 词：电磁木马 基于软件的瞬时电磁脉冲发射监测技术(Soft-TEMPEST) 应用程序编程接口(API)周期挖掘 傅里叶变换 频谱分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]