一种新型系统安全检测软件的设计与实现

Design and Implementation of a New System Security Detection Software

基于SDK平台,采用内核检测技术,设计开发了一种监视注册表值的变化;检测病毒、木马等恶意软件隐藏的文件、进程及内核模块等主要功能的新型的系统安全检测软件。通过进程端口映射查找系统打开的端口信息有效地查找木马及NTFS流文件中的流病毒;通过查看BHO、LSP防止浏览器和网络被劫持;通过查看HOOK的SSDT及SSDT Shadow恢复被修改的内容。经实际系统测试与比较表明,系统能有效地保障系统软件的安全。

Based on the SDK platform, by adopting kernel inspection technology, this paper designs and develops a new system security detection software for monitoring changes of registry value and detecting files, processes ahd kernel modules hidden by malicious software like virus and cockhorse. Port messages opened by the system are found by means of process port mapping for effective search of stream virus in cockhorse and NTFS stream files. BHO and I_SP are examined to prevent hijacking of browsers and networks. HOOK＇s SSDT and SSDT Shadow are checked to recover modified items. Actual system tests and comparison indicate that this system can effectively guarantee the safety of the system software.