摘要
注册表是WindowsNT操作系统的核心 ,对注册表进行动态监控和静态分析在入侵检测和系统安全方面有着重要的意义。论述了采用WindowsNT多进程和挂钩技术对注册表操作进行动态监控的原理和编程实现方法 。
Registry is the core of Windows NT operating system. It is significant for Windows NT registry to have dynamic monitor and static analysis in incursion detection and system security. The theory and programming method of monitoring the registry by Windows NT multi process and hook technology are discussed. The algorithm of analyzing the registry by traversing registry and matching registry key values technology is given.
出处
《计算机应用》
CSCD
北大核心
2003年第3期113-115,共3页
journal of Computer Applications
基金
浙江省教育厅科研项目 (2 0 0 1 0 4 56)
