基于句柄分析的Windows Rootkit检测技术研究

Windows Rootkits’s Detection based on Handle Analysis

作为网络入侵领域的一种新兴技术,Rootkit能隐藏入侵痕迹、阻止用户和检测软件发现恶意代码的存在,具有隐蔽性好、难以检测等特点。根据对Rootkit行为的分析,提出了一种基于句柄分析的Rootkit检测技术,该方法通过遍历内核句柄表,得到系统中运行的所有进程,再与调用API得到的进程列表对比,发现Rootkit隐藏的进程。实验证明,该方法对于Rootkit具有良好的检测效果。

Rootkit is a new technology in network intrusion, which could hide the trace of vicious behaviors and thus prevent the finding of malware by users and detection software. The behavior of common Rootkit has been analyzed and a method for detecting Rootkit based on handle analysis is proposed. Through comparing the process list obtained from API and scanning handle table, the hidden processes of Rootkit could be found. The experiment shows that this method could find the Rootkit hiding in the Windows OS.