摘要:
针对BIOS Rootkit难以检测的问题,提出一种基于行为特征的BIOS Rootkit的检测方法。该方法通过研究BIOS Rootkit工作原理和实现技术,对BIOS Rootkit的行为特征进行归纳、定义和形式化描述,在反编译的过程中提取行为,根据提取的行为构成BIOS Rootkit的完整程度进行恶意性判定。实验结果证明,该方法能够有效检测主流的BIOS Rootkit。
关键词:
BIOS安全,
逆向工程,
恶意代码
Abstract:
BIOS Rootkit is difficult to detect. Aiming at the problem, this paper proposes a behavior characteristics-based BIOS Rootkits detection method. By studying the BIOS Rootkits’ principles and key technologies, this method generalizes, defines and formally describes the behavior characteristics of BIOS Rootkit. Behaviors information is got in decompile phases, and the malicious level is judged according to the rate of a complete BIOS Rootkit formed by those behaviors. Experimental results prove that the method is effective to detect BIOS Rootkits.
Key words:
BIOS security,
reverse engineering,
malware
中图分类号:
郭致昌, 张平, 庞建民, 郭浩然, 崔晨. 基于行为特征的BIOS Rootkit检测[J]. 计算机工程, 2011, 37(2): 251-252.
GUO Zhi-Chang, ZHANG Beng, LONG Jian-Min, GUO Gao-Ran, CUI Chen. BIOS Rootkit Detection Based on Behavior Characteristics[J]. Computer Engineering, 2011, 37(2): 251-252.