二维码（扫一下试试看！） | | 高可靠In-VM隐藏进程对抗检测方法 | | A Highly Reliable In-VM Hidden Process Detection Countermeasure | | 投稿时间：2016-06-16 | | DOI：10.15918/j.tbit1001-0645.2018.03.014 | | 中文关键词:进程检测虚拟化In-VM模型Rootkit隐藏进程 | | English Keywords:process detectionvirtualizationIn-VM modelRootkithidden process | | 基金项目:北京理工大学科技创新计划重大项目（2011CX01015）；国家"二四二"计划项目（2005C48） | | | 摘要点击次数:774 | | 全文下载次数:456 | | 中文摘要: | | 通过隐藏进程执行恶意代码是信息攻击的一种重要手段，目前虚拟化平台中In-VM隐藏进程检测方法还存在被绕过和相关数据被篡改的可能性，针对这一问题，提出了一种高可靠In-VM隐藏进程对抗检测方法.该方法利用In-VM模型，通过改进虚拟化内存保护机制保护隐藏进程检测代码及其相关内核数据，确保其不被恶意篡改；通过准确劫持系统调用函数，并结合交叉视图方法检测隐藏进程，确保隐藏进程的检测算法无法被绕过.实验选取并构建多种典型的Rootkit隐藏进程，结果表明，该方法可以检测各种Rootkit隐藏进程，其隐藏进程检测代码及其相关数据无法被恶意篡改，检测算法和内存保护机制无法被绕过，而且改进的虚拟化内存保护机制对系统的性能影响更小，方法的可靠性高，实用价值大. | | English Summary: | | Executing malicious code via hidden process is a major way to carry out information attack. At present, hidden process detection methods based on In-VM model of virtualization platform can be attacked by circumventing and tampering with the relative data. To solve this problem, a highly reliable In-VM hidden process detection method was proposed. Firstly, an In-VM model and the memory protection mechanism of virtualization were developed to protect its detection code and relative kernel data from being maliciously changed. Secondly,by hijacking the system transfer function exactly and detecting the hidden process with a cross-view method, the detection algorithm was ensured from being circumvented. Finally, several typical Rootkits were built and chosen in experiments. The results show that, the proposed method can detect all kinds of hidden processes. Its detection code and relative kernel data cannot be tampered with and its detection algorithm and memory protection mechanism cannot be circumvented. And the developed memory protection mechanism has better performance in the system, showing a higher reliability and stronger pragmatic value. | | 查看全文查看/发表评论下载PDF阅读器 | |
徐斌,王成,徐文龙.高速杆式射流形成的数值模拟与实验研究[J].北京理工大学学报（自然科学版）,2018,38(4):331~337.XUBin,WANGCheng,XUWen-Long.NumericalSimulationandExperimentInvestigationonHypervelo ... 北京理工大学科研学术 本站小编 Free考研考试 2021-12-21计卫星,张露露,陈娟,邹天刚,罗辉,郭静,高志伟.一种时序数据多项式拟合加速方法[J].北京理工大学学报（自然科学版）,2018,38(5):519~524.JIWei-xing,ZHANGLu-lu,CHENJuan,ZOUTian-gang,LUOHui,GUOJing,GAOZhi-wei.P ... 北京理工大学科研学术 本站小编 Free考研考试 2021-12-21唐水源,焦思程,卢继平,张程焱,樊红丽.基于等效热-力载荷的20Cr2Ni4预应力车削残余应力模拟及实验[J].北京理工大学学报（自然科学版）,2018,38(7):661~667.TANGShui-yuan,JIAOSi-cheng,LUJi-ping,ZHANGCheng-yan,FANHong ... 北京理工大学科研学术 本站小编 Free考研考试 2021-12-21刘海庆,段卓平,蔡进涛,欧卓成,王桂吉,黄风雷.准等熵加载下PBXC03炸药起爆响应特性实验研究[J].北京理工大学学报（自然科学版）,2018,38(8):792~796.LIUHai-qing,DUANZhuo-ping,CAIJin-tao,OUZhuo-cheng,WANGGui-ji,HU ... 北京理工大学科研学术 本站小编 Free考研考试 2021-12-21贺秦禄,边根庆,邵必林,叶娜.一种基于云存储系统的自适应数据碎片恢复优化方法[J].北京理工大学学报（自然科学版）,2018,38(8):841~847.HEQin-lu,BIANGen-qing,SHAOBi-lin,YENa.AnAdaptiveDefragmentationRestoreOpt ... 北京理工大学科研学术 本站小编 Free考研考试 2021-12-21伍俊英,杨利军,吴宝,汪龙,陈朗.强激光烧蚀铝靶实验及数值模拟[J].北京理工大学学报（自然科学版）,2018,38(10):1018~1024.WUJun-ying,YANGLi-jun,WUBao,WANGLong,CHENLang.ExperimentandNumericalSimulatio ... 北京理工大学科研学术 本站小编 Free考研考试 2021-12-21徐林红,刘忠,韩光超,王瑞冬.不同晶粒度45#钢超声辅助微铣削实验研究[J].北京理工大学学报（自然科学版）,2018,38(11):1105~1110.XULin-hong,LIUZhong,HANGuang-chao,WANGRui-dong.ExperimentalStudyonUltraso ... 北京理工大学科研学术 本站小编 Free考研考试 2021-12-21闫书法,马彪,郑长松,王立勇,朱礼安,马源.基于劣化数据的综合传动装置剩余寿命预测[J].北京理工大学学报（自然科学版）,2018,38(11):1126~1133.YANShu-fa,MABiao,ZHENGChang-song,WANGLi-yong,ZHULi-an,MAYuan.Remain ... 北京理工大学科研学术 本站小编 Free考研考试 2021-12-21莫根林,金永喜,王雪娇,李忠新,吴志林.步枪弹侵彻明胶的空间弹道模型和实验研究[J].北京理工大学学报（自然科学版）,2018,38(12):1244~1251,1295.MOGen-lin,JINYong-xi,WANGXue-jiao,LIZhong-xin,WUZhi-lin.Ballisti ... 北京理工大学科研学术 本站小编 Free考研考试 2021-12-21刘雪岭,张奇.正烷烃液体云雾最小点火能实验研究[J].北京理工大学学报（自然科学版）,2018,38(12):1252~1255,1320.LIUXue-ling,ZHANGQi.ExperimentalStudyonMinimumIgnitionEnergyofn-AlkaneMists[J].T ... 北京理工大学科研学术 本站小编 Free考研考试 2021-12-21
| |
