Windows下BIOS Bootkit检测系统设计  

Design of detection system for BIOS Bootkit in Windows

作　　者：王文冰[1] 范乃梅[1] 刘胜利[2] 

机构地区：[1]郑州轻工业学院软件学院,河南郑州450001 [2]解放军信息工程大学信息工程学院,河南郑州450002

出　　处：《郑州轻工业学院学报（自然科学版）》2012年第6期86-89,共4页Journal of Zhengzhou University of Light Industry:Natural Science

基　　金：河南省科技攻关项目(102102210544)

摘　　要：为了对新型高隐藏性木马BIOS Bootkit实现快速检测、准确定位,提出一种BIOS Bootkit检测方案:IBBDS存放于引导盘,以尽早获取系统的执行权限,通过对IVT模块、ISA模块和HOOK INT13H模块的检测,在系统的启动过程即实现对BIOS Bootkit的捕获.试验验证了该检测方法的有效性.In order to quickly detect and accurately locate a new deeply concealed Trojan Horse Bootkit, the design of exclusive detecting system to BIOS Bootkit--IBBDS was put forward：IBBDS deposited in the bootable disk, to get the system implementation authority as soon as possible, the BIOS Bootkit capture was realized in the system start-up through the detection for IVT, ISA and HOOK INT 13 H module. The validity of this detection method was verified with experiment.

关 键 词：BIOS BOOTKIT WINDOWS 安全防护 高隐藏性木马 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]