基于可执行路径分析的隐藏进程检测方法

Method of Detecting Hidden Process Based on EPA

研究了内核模式下进程隐藏的原理和进程隐藏检测技术。在此基础上,提出了一种Windows操作系统内核模式下基于可执行路径分析(EPA)的隐藏进程检测技术。通过检查某些关键系统函数执行时所用的指令个数,来判断这些函数是否执行了多余的代码,从而断定系统被Windows Rootkit修改过了。利用该方法,可以检测出当前常规安全检测工具不能发现的系统恶意程序的进程隐藏。

The principle of hidden process and its detecting technology in the kernel mode has been analyzed. Fur- thermore, a new method based on Execution Path Analysis technology in the kernel mode of Windows operation system is put forward. The method judges whether more instructions are executed by calculating the number of instructions during the executing process of the function. Then, it gives the conclusion that whether the system is modified by Windows Root- kit or not. The method can be explored for detecting the intrusions of Trojan horse which other detective software for se- curity can not find.