一种防范rootkit入侵的内核模块加载机制  

A Mechanism of Loading Kernel Module to Prevent Kernel Level Rootkit

作　　者：谈潘攀[1] 

机构地区：[1]成都师范学院计算机科学系,四川成都611130

出　　处：《软件》2015年第4期123-127,共5页Software

摘　　要：内核级rootkit是破坏内核完整性的最大威胁,它通常通过冒充或篡改合法模块加载到内核,本文在对内核级rootkit防范技术对比分析的基础上,提出一种认证和检测相结合的内核模块加载机制,该机制把内核模块区分为信任模块和非信任模块,加载前者时首先验证其完整性,加载后者时,验证其身份和完整性,并实时检测其对内核数据的修改。实验表明,该机制能防范内核级rootkit的通过内核模块方式入侵。本文最后对该机制的优缺点及下一步研究方向进行了分析。Loading into the kernel by posing as or tampering with the legitimate module, Kernel-level rootkit is generally regarded as the main threat that breaks kernel integrity. Based on the research about kernel level rootkit prevention technology, this article presents a kernel module loading mechanism which possesses both the authentication and detection functions. This mechanism divides the kernel module into the trusted module and the non-trusted module. The kernel module will verify the integrity if the former is loaded. For the latter, it will verify the identity and the integrity,and detect the modification of the kernel data in real time. Experimental results show, this mechanism can prevent intrusion of the kernel level rootkit through kernel module. In the end, the author analyzes the advantages and disadvantages of this mechanism and its future research trend.

关 键 词：内核级rootkit 内核模块 认证 检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]