计算机工程 ›› 2012, Vol. 38 ›› Issue (14): 106-108.doi: 10.3969/j.issn.1000-3428.2012.14.031

• 安全技术 • 上一篇    下一篇

Windows注册表隐藏检测完全解决方案

王文奇,吴志刚,李世晓   

  1. (中原工学院计算机学院郑州市网络安全评估重点实验室,郑州 450007)
  • 收稿日期:2012-03-02 出版日期:2012-07-20 发布日期:2012-07-20
  • 作者简介:王文奇(1971-),男,副教授、博士、CCF会员,主研方向:电子取证,入侵检测;吴志刚,讲师、硕士;李世晓,工程师、硕士研究生
  • 基金项目:
    河南省科技攻关计划基金资助项目(082102210082, 082 102210092);河南省教育厅自然科学研究基金资助项目(2011A520 049)

Perfect Solution of Windows Registry Concealment Detection

WANG Wen-qi, WU Zhi-gang, LI Shi-xiao   

  1. (Zhengzhou Key Lab of Network Security Assessment, School of Computer Science, Zhongyuan University of Technology, Zhengzhou 450007, China)
  • Received:2012-03-02 Online:2012-07-20 Published:2012-07-20

摘要: 在分析Windows注册表系统及注册表隐藏技术的基础上,提出一个完全解决方案用于检测被Rootkit等木马隐藏的注册表项。设计底层数据复制算法来复制注册表文件,以解决无法直接读取注册表信息的问题,通过多层次匹配算法检测得到注册表的隐藏位置。实验结果证明,该方案可以突破Windows系统的限制,检测到从内核层到应用层所有被隐藏和修改的注册表信息及其隐藏位置,且不受Rootkit木马干扰。

关键词: 注册表隐藏, 底层数据复制, 隐藏检测, 注册表信息提取, 多层次匹配算法, Rootkit木马

Abstract: According to the problem that registry item hidden by Rootkit Trojan can not be effectively detected, this paper proposes a prefect solution by analyzing the Windows registry system and registry concealment technique. The crucial problems are solved, such as the lower-level data copying algorithm which is used to copy registry files, the multi-level match algorithm which is used to detect the hidden position. Experimental result shows that the solution can breakthrough restrictions of Windows, detect all hidden nodes from the kernel layer to application layer unaffected, and get rid of interference of Rootkit.

Key words: registry concealment, lower-level data copying, concealment detection, registry information extraction, multi-level matching algorithm, Rootkit trojan

中图分类号: