摘要
对木马模型框架的理论及其协同隐藏模型进行研究和分析,给出BIOS Rootkit协同隐藏模型的具体形式化描述,提出一种在Windows环境下基于协同特征的BIOS Rootkit检测技术。针对现有BIOS Rootkit检测技术存在能查但不能正常恢复的问题,采用搜索特征码并动态恢复的技术解决。实验结果表明,该检测技术具有良好的可靠性、检测效率和完整性。
To research and analyze the theory of framework for modeling trojans and trojans model about cooperative concealment,this paper gives BIOS Rootkit’s formal model about cooperative and presents a BIOS Rootkit detection technology based on the character of cooperation in Windows environment.Current detection technology of BIOS Rootkit can detect but lacks the function of resuming,so the method uses characteristic of codes searching and dynamic resuming to solving it.Experimental results show that this is a detection method of higher reliability,efficiency and integrity.
出处
《计算机工程》
CAS
CSCD
北大核心
2010年第15期134-136,139,共4页
Computer Engineering
基金
四川省青年科技基金资助项目(07ZQ026-004)
