基于数据特征的内核恶意软件检测

发布时间：2018-06-23 17:44

本文选题：内核恶意软件 + 数据特征　；参考：《软件学报》2016年12期

【摘要】：内核恶意软件对操作系统的安全造成了严重威胁.现有的内核恶意软件检测方法主要从代码角度出发,无法检测代码复用、代码混淆攻击,且少量检测数据篡改攻击的方法因不变量特征有限导致检测能力受限.针对这些问题,提出了一种基于数据特征的内核恶意软件检测方法,通过分析内核运行过程中内核数据对象的访问过程,构建了内核数据对象访问模型;然后,基于该模型讨论了构建数据特征的过程,采用动态监控和静态分析相结合的方法识别内核数据对象,利用EPT监控内存访问操作构建数据特征;最后讨论了基于数据特征的内核恶意软件检测算法.在此基础上,实现了内核恶意软件检测原型系统MDS-DCB,并通过实验评测MDS-DCB的有效性和性能.实验结果表明:MDS-DCB能够有效检测内核恶意软件,且性能开销在可接受的范围内.
[Abstract]:Kernel malware poses a serious threat to the security of the operating system. The existing kernel malware detection methods mainly from the point of view of code, can not detect code reuse, code obfuscation attacks, and a small number of methods to detect data tampering attacks due to the invariant characteristics of limited detection ability. Aiming at these problems, a kernel malware detection method based on data features is proposed. By analyzing the access process of kernel data objects during kernel running, a kernel data object access model is constructed. Based on this model, the process of constructing data features is discussed. Dynamic monitoring and static analysis are used to identify kernel data objects, and EPT monitoring memory access operations are used to construct data features. Finally, the kernel malware detection algorithm based on data features is discussed. On this basis, the kernel malware detection prototype system MDS-DCB is implemented, and the effectiveness and performance of MDS-DCB are evaluated through experiments. Experimental results show that: MDS-DCB can effectively detect kernel malware, and the performance overhead is within acceptable range.
【作者单位】：解放军信息工程大学;数学工程与先进计算国家重点实验室;
【基金】：“核高基”国家科技重大专项(2013JH00103) 国家高技术研究发展计划(863)(2009AA01Z434)~~
【分类号】：TP316;TP309

【相似文献】