Windows操作系统信息监控方法研究.pdfVIP

ISSN1009-3044 and ComputerKnow蛐eTechnology电奠知识‘i技术 Tel：+86-55l一56909635690964 V01．5，No．21，July2009，PP．5840—5843 Windows操作系统的信息监控方法研究 张君瑞，陈一J、佳，曾冬梅 (中国电信股份有限公司珠海分公司珠海519002) 摘要：随着计算机网络技术的发展，安全问题日益受到人们的重视。计算机信息安全可分为网络安全和主机安全两大类。长期以来 人们很重视网络安全而忽视主机安全．随着信息安全技术的发展．主机安全问题也越来越受到重视。主要从工程实现角度研究了几 hook方法。基于应用层W抽32函数的Detour方法和基于内核层的DikerDriver方法。 driver方法 关键词：信息安全；Hook方法；Detour方法；Filter 中图分类号：雠 文献标识码：A 文章编号：1009-3044(2009)2l-5840州 ResearchOnInformation MethodsBasedonWindows Operating Monitoring System ZHANG Jun—rui，CHENXiao-jia，ZENGDong—mei TelecomZhuhai519002 (Zhuhai Branch，China China) prefecture Abstract：Withthe of network are concernedaboutthe developmentcomputertechnology，peopleincreasingly security informationcanbedividedintotwo andhost a time attach puter security majorcategories：networksecurity security．Forlong people great tOnetwork and thatofhost the ofinformation importance neglect security．Withdevelopment technology，hostsecurity security security areconsideredmoleandmore fromthe of aremadeaboutseverallocalmeth- problems important．Mainlyengineeringpointview。studies odsof informanonbasedonwindows system tOthestratifiedWindowssoftware monitoring operatingbased．According agemadeaboutthehookmethodbasedonthe windows detourmethodsbasedonthe analysis applicationlayer message，the win32 thefilterdrivermethodsbasedthecore laver function，and 0n hyer． words：information drivermethods