USB可移动存储设备监控软件研究与实现  

Research and Implementation on USB Monitor Software for Removable Devices

作　　者：杨思燕[1] 

机构地区：[1]陕西广播电视大学计算机与信息管理系,陕西西安710119

出　　处：《计算机技术与发展》2013年第12期151-154,160,共5页Computer Technology and Development

基　　金：国家自然科学基金资助项目(61072109;61272280);西安市科技局计划(CXY1133(1);CXY1119(6))

摘　　要：针对USB可移动存储设备日益成为越来越多的病毒、木马的主要攻击对象,尤其是窃密木马等会扫描接入系统的USB可移动存储设备并将机密文件秘密地复制并通过网络发送出去,造成严重的安全隐患的问题,文中在微软文件系统过滤驱动开发模型Sfilter的基础上,设计开发了一款USB可移动存储设备监控软件,通过截获对于USB可移动存储设备内文件操作的IRP(I/O Request Packet),分析出相应的文件操作类型,对截获到的IRP进行不同的处理,实现了可控的安全进程规则与防拷贝功能,并结合相应的日志显示最终保证了USB可移动存储设备内文件的安全性。经过实验测试,软件系统运行正常,能够有效监控USB可移动存储设备内文件的访问和存取等操作。Aiming at the problem that the USB portable storage devices have been considered as one of the chief attacking targets by an increasing number of computer viruses and Trojans, some of which can even scan for the available USB device, sneakingly copying its se- cre, t documents and then spreading them with network, finally triggering serious security issues, based on Sfilter, the filtering driver proto- type of Microsoft fi｜e system,develop a USB monitor software whose functions by intercepting various IRP （I/O Request Packet） of the USB＇deviee are to work out the corresponding file operation types and take relevant reactions. The system supports custom-made security proeess rules, achieves anti-copying and guarantees the security of the USB device by showing the logs. The experiment shows that the system works well and is able to effectively supervise the accessing to the files in USB device.

关 键 词：USB可移动存储设备 文件系统过滤驱动 文件监控 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]