感染型病毒防御系统  

Defense of Infectious Viruses

作　　者：郑焕鑫[1] 叶小平[1] 

机构地区：[1]华南师范大学计算机学院,广州510631

出　　处：《计算机系统应用》2013年第2期15-18,共4页Computer Systems & Applications

基　　金：广东省自然科学基金(9151027501000054;s2011010003409);2011年华南师范大学大学生创新实验计划

摘　　要：通过设计一个简单感染型病毒,发现主流杀毒软件主动防御策略无法对其进行有效拦截.根据在正常情况下系统PE文件不会发生变化的特性,提出通过拦截对已有PE文件写操作来实现主动防御的方法,并设计相应系统PEPS.仿真实验表明,该方法对于感染型病毒的防御效果优于主流杀毒软件.After designing a simple infectious virus, we fred the Active Defense Strategy of mainstream anti-virus software can＇t intercept the infectious operations effectively. Under normal circumstances, the original PE files of the system cannot be modified. According to this characteristic, the following article develops a way to realize initiative recovery by monitoring illegal write operation of original PE file and design a system - PEPS. The simulation experiments show that the method is more effective on the defense of infectious viruses than mainstream anti-virus software.

关 键 词：PE感染型病毒 写操作 拦截 PEPS 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]