摘要： 对木马模型框架的理论及其协同隐藏模型进行研究和分析，给出BIOS Rootkit协同隐藏模型的具体形式化描述，提出一种在Windows环境下基于协同特征的BIOS Rootkit检测技术。针对现有BIOS Rootkit检测技术存在能查但不能正常恢复的问题，采用搜索特征码并动态恢复的技术解决。实验结果表明，该检测技术具有良好的可靠性、检测效率和完整性。

关键词: 协同隐藏, BIOS Rootkit技术, 检测

Abstract: To research and analyze the theory of framework for modeling trojans and trojans model about cooperative concealment, this paper gives BIOS Rootkit’s formal model about cooperative and presents a BIOS Rootkit detection technology based on the character of cooperation in Windows environment. Current detection technology of BIOS Rootkit can detect but lacks the function of resuming, so the method uses characteristic of codes searching and dynamic resuming to solving it. Experimental results show that this is a detection method of higher reliability, efficiency and integrity.

Key words: cooperative concealment, BIOS Rootkit technology, detection

中图分类号: 

• TP309