基于TWPos内核完整性保护  

Protection of Kernel Integrity with Two-Mode Protection Operation System

作　　者：何进[1] 范明钰[1] 王光卫[1] 

机构地区：[1]电子科技大学计算机科学与工程学院,成都611731

出　　处：《电子科技大学学报》2015年第6期892-898,共7页Journal of University of Electronic Science and Technology of China

基　　金：国家863项目(2009AA01Z435;2009AA01Z 403);国家自然科学基金(60373109;60272091)

摘　　要：内核rookits攻击对内核的完整性构成致命威胁,因此对内核rootkits防护是内核完整性保护的重点。当前研究主要侧重于内核rootkits探测和防护,不足之处在于:1)rootkits防护存在单一保护模式;2)内核rootkits探测只能做探测使用,即便发现内核已经受到攻击,也无能为力。鉴于这种情况,该文设计了一种内核完整性保护方法,采用安全认证保护和探测恢复两种方式(TWPos)保护操作系统,同时具备探测和防护能力,即便内核受到攻击也能进行恢复。实验表明,TWPos系统既能全面有效的防护,而且又不牺牲系统性能,并且兼容多种OS系统。Kernel-level rootkits attacks pose a deadly threat to kernel integrity, and kemel rootkits is currently a research focus, primarily focused on kernel-level rootkits detection and rootkits protection. However, these studies are always flawed： the rootkits protection presents a single protected mode; kernel-level rootkits detection can only do the detection use, even if the kernel has been found to be attacked, there is no method to solve. Give this situation, we design a two-mode protection operation system （TWPos）, this is, a kernel-level integrity protection method along with detection and protection capability, even if the kernel is already under attack, TWPos also recoveries kernel integrity. The experiments show that TWPos is a comprehensive and effective protection system without sacrificing system performance for the price, and is compatible with a variety of OS systems.

关 键 词：探测恢复复试 内核完整性 ROOTKITS 安全认证保护模式 TWPos 虚拟机管理 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]