基于Wine的Windows安全机制模拟及沙箱系统实现  

Windows Security Mechanisms Simulation and Sandbox System Implementation Based on Wine

作　　者：刁铭智 周渊[2] 李舟军[1] 赵宇飞[1] 

机构地区：[1]北京航空航天大学计算机学院,北京100191 [2]国家计算机网络应急技术处理协调中心,北京100029

出　　处：《计算机科学》2017年第11期246-252,267,共8页Computer Science

基　　金：国家自然科学基金(61170189;61370126;61202239);国家"八六三"高技术研究发展计划项目(2015AA016004);教育部博士点基金(20111102130003)资助

摘　　要：基于开源软件Wine模拟了ASLR和UAC Virtualization两种Windows安全机制,使得Wine环境更接近真实的操作系统且更加安全,并利用wineserver机制初步实现了动态行为检测功能,同时借助Wine自身的.wine目录作为样本的运行环境,最终形成了一个较真实的沙箱系统。实验结果表明,该沙箱系统具备了ASLR和UAC Virtualization两种安全机制的基本特征。与其他沙箱系统相比,该系统不仅可以对未知样本进行有效的行为检测,而且具有占用资源少、隔离性强、回滚速度快等突出特点,因此能够很好地满足批量部署和运行的需要。We simulated two Windows security mechanisms,adress space layout randomization（ASLR）and user account control（UAC）Virtualization,based on open source software Wine.The two mechanisms make the Wine＇s environment closer to the real operating system and safer.Based on the two security mechanisms,we further presented a relatively real sandbox system,which employs the wineserver mechanism and utilizes the.wine directory of Wine as the running environment for samples to detect the dynamic behavior.The experimental results show that the proposed sandbox system presents the basic characteristics of ASLR and UAC Virtualization.Compared with other sandboxes,our proposed sandbox system can not only effectively detect behaviors of unknown samples,but also has features like low resource utilization,good isolation and fast status rollback,which make it meet the requirements of batch deployment and operation.

关 键 词：WINE 地址空间布局随机化 用户账户控制虚拟化 动态行为检测 沙箱 

分 类 号：TP311.56[自动化与计算机技术—计算机软件与理论]