基于NDIS中间层的木马防护机制研究及实现  

Research on and Implementation of Protective Mechanism of Trojan Based on NDIS Intermediate Layer

作　　者：洪双喜[1] 雷涛[1] 

机构地区：[1]华北水利水电学院信息工程学院,河南郑州450011

出　　处：《电子科技》2013年第5期156-159,共4页Electronic Science and Technology

摘　　要：通过对木马程序的特征、种类及通信方式的特点进行综合分析,在Windows平台下,提出了一种利用NDIS中间层驱动技术,在内核层面上进行防护的机制。对捕获的数据包的IP地址、端口号及所属的进程进行分析判断,实现对木马通信的拦截和对木马进程的识别。在对木马病毒通信拦截率相同的情况下,该机制在对数据包的处理速度上,明显优于类似功能的防木马软件。Through analyzing the characteristics, types and communication mode of the Trojan program, a pro-tection mechanism in kernel level based on NDIS intermediate driver technique on the windows platform is put forward. IP address and port number and the process of captured data packet are analyzed and judged to realize interception of Trojan virus communications and the identification of Trojan process. With the same interception rate of Trojan commu- nications, it is obviously superior to the similar functional anti-Trojan software in the data packet processing speed.

关 键 词：木马病毒 NDIS驱动 IP信息库 网络安全 合法进程表 

分 类 号：TP311.563.2[自动化与计算机技术—计算机软件与理论]