摘要： Linux下VFS层rootkit隐藏层次深，查杀难度大。其典型应用adore-ng在实际使用时无法屏蔽卡巴斯基等实时监控软件，破坏隐蔽效果。针对该问题，运用系统调用修改和VFS写函数内容过滤2种方法，设计并实现了相应的改进方案。仿真实验结果表明，该方案易于实现、效果良好，可以有效提高adore-ng的隐蔽性能。

关键词: Linux内核, 信息安全, rootkit技术, VFS层

Abstract: The kernel rootkit at VFS layer hides deeply in Linux, and it is hard to be detected and killed. adore-ng is a typical rootkit application, but it can not survive some of the real-time monitoring programs, such as the Kaspersky Internet security. Aiming at this problem, the paper proposes two different solutions. One is by the modification of relevant system calls, the other is by filtering the content written by the VFS write call. Both these two approaches are easy to be implemented. Experimental results show the approaches are effective.

Key words: Linux kernel, information security, rootkit technique, VFS layer

中图分类号: 

• N945