Windows系统内核Rootkit的检测技术研究-信息安全专业论文.docxVIP

华 华 中 科 技 大 学 硕 士 学 位 论 文 II II Abstract With fast development of computer technology and the rapid prevalence of the Internet,computer systems are confronted with more and more damages from malwares,such as virus,trojan and worm, and a technology called Rootkit are used both by malware and security software,which makes the conflict between them spill over into the kernel of Windows system. It is a practicable solution against kernel Rootkit to check the integrity of kernel function and the integrity of function address table,such as system service descriptor table and interrupt descriptor table.But it is very diffcult to locate which function the kernel execution is redirected to.Besides,there are so many true positives and false negatives using this method,wich makes common users confused. Some undocumented kernel data strucures can be used to detect kernel Rootkits,wich also can be used by kernel Rootkit to bypass these detect methods based on these structures. Based on the characteristics of Windows system kernel Rootkit and analysis of detect method against Rootkit now available,combined with the research on WRK source code and Rootkit samples with a large number,new detect methods against Rootkit based inline hook,outline hook and direct kernel object manipulation were delivered,which were implement ed in a detect sofaware.And an advanced pattern matching algorithm based on BM algorithm is used to enhance the efficiency of Rootkit detection.The test result against several Windows Rootkit samples proves that new detect methods delivered in this paper have advantages in accuracy and stability on the detect of Rootkit both based on kernel hook and direct kernel object manipulation compared to the test result from other detect tool on Windows platform. Key Words : System Kernel, Kernel Hook, Direct Kernel Manufacture, Pattern Matching Algorithm 独创性声明 本人声明：所呈交的学位论文是我个人在导师指导下进行的研究工作及取得的 研究成果。尽我所知，除文中已经标明引用的内容外，本论文不包含任何其他个人 或集体已经发表或撰写过的研究成果。对本文的研究做出贡献的个人和集体，均已 在文