摘要： 为避免嵌入式操作系统的进程受到恶意软件的修改破坏，提出一种适合于嵌入式操作系统的进程监测器。监测器周期性地对系统进程控制块进行检测恢复，通过设置进程检查点为系统提供恢复操作进程，并在Linux上进行实现，给出主要的数据结构和实现过程。实验结果表明，监测器的运行对系统性能影响小，能对系统进程进行有效的检测恢复。

关键词: 进程监测器, 安全攻击, 检测点, 检测恢复

Abstract: In order to protect the process in kernel from attack, a process inspector for embedded system is designed and implemented. The process inspector periodically detects and recovers the system inconsistency. This protection method can provide recovery actions for the system which is based on checkpoint and recovery technique. It realizes in Linux and gives experimental result and analysis. Experimental results show the the inspector can correctly detect and recover the system inconsistency with acceptable penalty to the system performance.

Key words: process inspector, security attack, checkpoint, detection recovery

中图分类号: 

• TP391