基于内存池标记快速扫描技术的Windows内核驱动对象扫描  

Object Scanning of Windows Kernel Driver Based on Pool Tag Quick Scanning

作　　者：翟继强[1] 肖亚军 杨海陆 王健[1] ZHAI Jiqiang;XIAO Yajun;YANG Hailu;WANG Jian(School of Computer Science and Technology, Harbin University of Science and Technology, Harbin 150080, China)

机构地区：[1]哈尔滨理工大学计算机科学与技术学院

出　　处：《西北工业大学学报》2019年第5期1044-1052,共9页Journal of Northwestern Polytechnical University

基　　金：国家自然科学基金(61403109);黑龙江省自然科学基金(F2016024);黑龙江省教育厅科技面上项目(12531121)资助

摘　　要：计算机内存取证领域中,基于内存池标记的池标记扫描技术在对内核驱动对象进行扫描时需要对全部物理内存进行详尽搜索,效率很低。提出了一种使用内存池标记快速扫描技术扫描Windows内核驱动对象的方法。该方法采用内存池标记快速扫描技术,减小扫描的内存范围,然后根据内核驱动对象特征对驱动对象进行快速扫描,以帮助调查人员判断驱动是否存在异常。实验表明,使用内存池标记快速扫描技术进行内核驱动对象扫描可以在保证误报率不变的情况下,极大地提高扫描效率,减少在扫描步骤花费的时间。In the memory forensics,the Pool Tag Scanning based on the memory pool tag requires a detailed search of the physical memory when scanning the kernel driver object,which is very inefficient.The object scanning of Windows kernel driver by using the pool tag quick scanning is proposed.The method uses the quick pool tag scanning to reduce the memory range of the scan,and then scan the driver object according to the characteristics of the kernel driver object quickly,to help investigator to determine whether the driver is normal.Experimental results shows that the scanning efficiency for object scanning of kernel driver is improved greatly by using the quick pool tag scanning technology and the time spent in the scanning step is reduced while ensuring the false alarm rate is same.

关 键 词：内存取证 内存池标记 内存池标记快速扫描 内核驱动对象 

分 类 号：TP319[自动化与计算机技术—计算机软件与理论]