基于行为特征的BIOS Rootkit检测

BIOS Rootkit Detection Based on Behavior Characteristics

针对BIOS Rootkit难以检测的问题,提出一种基于行为特征的BIOS Rootkit的检测方法。该方法通过研究BIOS Rootkit工作原理和实现技术,对BIOS Rootkit的行为特征进行归纳、定义和形式化描述,在反编译的过程中提取行为,根据提取的行为构成BIOS Rootkit的完整程度进行恶意性判定。实验结果证明,该方法能够有效检测主流的BIOS Rootkit。

BIOS Rootkit is difficult to detect. Aiming at the problem, this paper proposes a behavior characteristics-based BIOS Rootkits detection method. By studying the BIOS Rootkits＇ principles and key technologies, this method generalizes, defines and formally describes the behavior characteristics of BIOS Rootkit. Behaviors information is got in decompile phases, and the malicious level is judged according to the rate of a complete BIOS Rootkit lormcd by those behaviors. Experimental results prove that the method is effective to detect BIOS Rootkits.