基于磁盘数据分析的Bootkit静态检测研究与实现  

RESEARCH AND IMPLEMENTATION OF DISK DATA ANALYSIS-BASED STATIC BOOTKIT DETECTION

作　　者：金戈[1] 薛质[1] 王轶骏[1] 

机构地区：[1]上海交通大学信息安全工程学院,上海200240

出　　处：《计算机应用与软件》2015年第6期52-56,共5页Computer Applications and Software

基　　金：国家自然科学基金项目(61332010)

摘　　要：Bootkit这种新型恶意代码通过感染磁盘的主引导记录(MBR)或卷引导记录(VBR)来获取执行权,从而将加载时间大大提前以使常规基于动态行为分析的安全软件都不能对其进行有效检测[1]。针对Bootkit检测这一难题提出一种新型静态检测方法,设计实现相关的MBR匹配算法,并针对国内外知名的Bootkit恶意代码样本进行实验。实验结果显示此方法可以有效检测出当今主流的Bootkit恶意代码,进而证明了静态检测思路的可行性。Bootkit,a novel malicious code,grabs the right of execution by infecting MBR or VBR so that greatly advances the loading time thus disables the effective detection on it by the conventional security software based on dynamic behaviour analysis[1].We propose a novel static detection method in this paper aiming at such a difficulty of Bootkit detection,design and implement correlated MBR matching algo-rithm.Moreover,the experiment is carried out against the Bootkit malicious code sample well-known at home and abroad.Experimental re-sults show that this method can effectively detect today’s mainstream Bootkit malicious codes,and further proves the feasibility of static detec-tion idea.

关 键 词：BOOTKIT 主引导记录卷引导记录 MBR 匹配检测算法 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]