基于NDIS中间层的木马防护机制研究及实现

Research on and Implementation of Protective Mechanism of Trojan Based on NDIS Intermediate Layer

通过对木马程序的特征、种类及通信方式的特点进行综合分析,在Windows平台下,提出了一种利用NDIS中间层驱动技术,在内核层面上进行防护的机制。对捕获的数据包的IP地址、端口号及所属的进程进行分析判断,实现对木马通信的拦截和对木马进程的识别。在对木马病毒通信拦截率相同的情况下,该机制在对数据包的处理速度上,明显优于类似功能的防木马软件。

Through analyzing the characteristics, types and communication mode of the Trojan program, a pro-tection mechanism in kernel level based on NDIS intermediate driver technique on the windows platform is put forward. IP address and port number and the process of captured data packet are analyzed and judged to realize interception of Trojan virus communications and the identification of Trojan process. With the same interception rate of Trojan commu- nications, it is obviously superior to the similar functional anti-Trojan software in the data packet processing speed.