一种自动检测内核级Rootkit并恢复系统的方法

A Method to Automatically Detect and Recover from Kernel Level Rootkit

Rootkit是黑客入侵系统后保留后门常用的一项技术。目前不存在一种能自动检测内核级rookit并恢复系统的方法。该文在详细剖析内核级rootkit原理的基础上,提出了一种自动检测内核级rootkit并恢复系统的方法。该方法不仅对目前出现的所有内核级rootkit有效,而且考虑了将来可能出现的更高级的rootkit。

Rootkit is a common technology used by hackers to keep backdoors on the compromised system. There is no method to automatically detect and recover from kernel level rnotkits at present. This paper analyzes the principle of kernel level rootkits, and proposes a method to automatically detect and recover from kernel level rootkits. This method is useful to the existing rootkits and the rootkits that may appear in future.