作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2011, Vol. 37 ›› Issue (2): 251-252. doi: 10.3969/j.issn.1000-3428.2011.02.088

• 开发研究与设计技术 • 上一篇    下一篇

基于行为特征的BIOS Rootkit检测

郭致昌,张 平,庞建民,郭浩然,崔 晨   

  1. (解放军信息工程大学信息工程学院,郑州 450002)
  • 出版日期:2011-01-20 发布日期:2011-01-25
  • 作者简介:郭致昌(1985-),男,硕士研究生,主研方向:逆向工程;张 平,副教授;庞建民,教授;郭浩然,博士研究生;崔 晨,硕士研究生
  • 基金资助:

    国家“863”计划基金资助项目(2009AA01Z434);河南省重大科技攻关计划基金资助项目(092101210501)

BIOS Rootkit Detection Based on Behavior Characteristics

GUO Zhi-chang, ZHANG Ping, PANG Jian-min, GUO Hao-ran, CUI Chen   

  1. (Institute of Information Engineering, PLA Information Engineering University, Zhengzhou 450002, China)
  • Online:2011-01-20 Published:2011-01-25

摘要:

针对BIOS Rootkit难以检测的问题,提出一种基于行为特征的BIOS Rootkit的检测方法。该方法通过研究BIOS Rootkit工作原理和实现技术,对BIOS Rootkit的行为特征进行归纳、定义和形式化描述,在反编译的过程中提取行为,根据提取的行为构成BIOS Rootkit的完整程度进行恶意性判定。实验结果证明,该方法能够有效检测主流的BIOS Rootkit。

关键词: BIOS安全, 逆向工程, 恶意代码

Abstract:

BIOS Rootkit is difficult to detect. Aiming at the problem, this paper proposes a behavior characteristics-based BIOS Rootkits detection method. By studying the BIOS Rootkits’ principles and key technologies, this method generalizes, defines and formally describes the behavior characteristics of BIOS Rootkit. Behaviors information is got in decompile phases, and the malicious level is judged according to the rate of a complete BIOS Rootkit formed by those behaviors. Experimental results prove that the method is effective to detect BIOS Rootkits.

Key words: BIOS security, reverse engineering, malware

中图分类号: