Windows主机入侵防御系统研究综述  

An overview study of Windows-based intrusion prevention system

作　　者：吕滨[1] 刘晓红[1] 关双城[1] 

机构地区：[1]黑龙江工程学院计算机科学与技术学院,黑龙江哈尔滨150050

出　　处：《黑龙江工程学院学报》2013年第3期63-66,共4页Journal of Heilongjiang Institute of Technology

基　　金：黑龙江省教育厅资助项目(12531536)

摘　　要：主机入侵防御是基于操作系统API监控的一种主动性安全防御技术,是面向客户端的安全解决方案。简要介绍该课题相关的技术背景和研究目标;系统论述主机入侵防御系统的防御思想、技术框架和基本特征;重点探讨Windows系统的API HOOK技术、基于API的行为监控和几种典型的异常行为分析技术,讨论各种行为分析技术的特点及其应用;最后指出该课题当前研究的技术瓶颈,并提出下一步研究的思路和方向。Host-based intrusion prevention is an active security defense technology based on the operating system API monitoring, which is a security solution for the client-end. It briefly introduces the technical background and research objectives of the related topics. The prevention thought, framework and basic characteristics of host intrusion prevention system are presented and focused on the key technology of Windows API HOOK, behavior monitoring based on API and some of typical abnormal behavior analysis. And all the technology performance and aplication are provide. Finally the technical bottleneck of the current study is revealed and the countermeasures are given.

关 键 词：入侵防御 主动防御 API HOOK行为分析 

分 类 号：TP393.0[自动化与计算机技术—计算机应用技术]