作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2010, Vol. 36 ›› Issue (15): 134-136,139. doi: 10.3969/j.issn.1000-3428.2010.15.047

• 安全技术 • 上一篇    下一篇

基于协同特征的BIOS Rootkit检测技术

邓立丰1,王宏霞2   

  1. (1. 西南交通大学信息科学与技术学院,成都 630031; 2. 西南交通大学信息安全与国家计算网格实验室,成都 630031)
  • 出版日期:2010-08-05 发布日期:2010-08-25
  • 作者简介:邓立丰(1983-),男,硕士研究生,主研方向:Rootkitt检测技术,数字水印;王宏霞,教授、博士、博士生导师
  • 基金资助:
    四川省青年科技基金资助项目(07ZQ026-004)

BIOS Rootkit Detection Technology Based on Cooperation Feature

DENG Li-feng1, WANG Hong-xia2   

  1. (1. School of Information Science and Technology, Southwest Jiaotong University, Chengdu 630031; 2. State Laboratory for Information Security and Computing Grid, Southwest Jiaotong University, Chengdu 630031)
  • Online:2010-08-05 Published:2010-08-25

摘要: 对木马模型框架的理论及其协同隐藏模型进行研究和分析,给出BIOS Rootkit协同隐藏模型的具体形式化描述,提出一种在Windows环境下基于协同特征的BIOS Rootkit检测技术。针对现有BIOS Rootkit检测技术存在能查但不能正常恢复的问题,采用搜索特征码并动态恢复的技术解决。实验结果表明,该检测技术具有良好的可靠性、检测效率和完整性。

关键词: 协同隐藏, BIOS Rootkit技术, 检测

Abstract: To research and analyze the theory of framework for modeling trojans and trojans model about cooperative concealment, this paper gives BIOS Rootkit’s formal model about cooperative and presents a BIOS Rootkit detection technology based on the character of cooperation in Windows environment. Current detection technology of BIOS Rootkit can detect but lacks the function of resuming, so the method uses characteristic of codes searching and dynamic resuming to solving it. Experimental results show that this is a detection method of higher reliability, efficiency and integrity.

Key words: cooperative concealment, BIOS Rootkit technology, detection

中图分类号: