Windows关键技术研究及其在内网安全中的应用

发布时间：2018-08-13 16:20

【摘要】：随着计算机技术和通讯技术的飞速发展,网络正逐步改变着人们的工作方式和生活方式,成为当今社会发展的一个主题。随着网络使用范围的扩大,恶意代码的攻击目的,也由破坏能力炫耀转向了经济利益的获取和政治破坏的目的。特别的,当恶意程序在内网中对内网终端进行大规模感染的时候,它的破坏力和持久性就会成倍的增加。内网终端安全主要是针对系统消息的过滤及其处理,内网终端安全技术主要分为用户模式的消息过滤技术和内核模式的消息过滤技术。本文分别研究了用户模式的Windows钩子技术和内核模式中的文件过滤驱动以及磁盘过滤驱动,解决了内网终端安全面临最大的问题,即恶意程序防控问题,实现了内网终端安全中的系统固化和恶意程序检测,主要研究内容如下:1.研究并分析了在内网安全管理系统中,内网终端安全在针对恶意程序防控所涉及的两个方面,包括恶意程序的防护和恶意程序检测,并针对这两个方面各自分析了在高安全需求的内网中需要达到的要求。2.研究了 Windows驱动开发技术和磁盘过滤驱动技术,这其中,重点研究了三个关键性难题:在磁盘过滤驱动中得到磁盘物理文件扇区地址的问题、获取物理文件在系统中的簇列表的问题和文件的簇地址与扇区地址建立对应关系的问题,并在此研究基础上,实现了基于磁盘过滤驱动的操作系统固化方案,实现了磁盘与内存的注册表单向数据单向传递,从而避免了注册表重定向带来的注册表项链接破坏问题。3.研究了 Windows内核设备通信机制和文件系统过滤驱动技术,这其中,解决了在创建文件时文件系统过滤驱动如何获取准确的创建文件名称的问题、文件系统过滤驱动的派遣函数与完成函数不在同一线程导致缓冲区失效问题以及跨卷重命名文件时文件系统过滤驱动无法捕获到重命名消息的问题。并在此研究基础上,实现了基于文件系统过滤驱动的操作系统固化方案。4.提出了低漏检率的恶意程序检测方案。该方案利用Windows钩子技术提取程序的运行序列,并进行抽象化处理,以此为程序特征,减少了特征中冗余信息的含有量,并且创新的引入了原本是计算相似度的k-gram算法,将此算法的计算结果作为SVM分类算法输入,与其他利用SVM分类算法进行检测的方案相比,不仅降低了输入的向量维度提高了检测方案的计算效率,而且达到了漏检率最低为1.91%的效果。
[Abstract]:With the rapid development of computer technology and communication technology, the network is gradually changing the way of work and life of people, and has become a theme of social development. With the expansion of the scope of use of the network, the purpose of malicious code attack has also changed from showing off its destructive ability to the purpose of obtaining economic benefits and political destruction. In particular, when malicious programs intranet terminal mass infection, its destructive power and durability will multiply. The security of intranet terminal is mainly aimed at the filtering and processing of system message. The security technology of intranet terminal is mainly divided into user mode message filtering technology and kernel mode message filtering technology. In this paper, the Windows hook technology in user mode and file filter driver and disk filter driver in kernel mode are studied respectively, which solves the biggest problem of the security of intranet terminal, that is, the prevention and control of malicious program. The system solidification and malicious program detection in the intranet terminal security are realized. The main research contents are as follows: 1. This paper studies and analyzes two aspects of intranet security management system, including the protection of malicious programs and the detection of malicious programs. According to these two aspects, the requirements of the inner network with high security requirements are analyzed. 2. 2. In this paper, the Windows driver development technology and disk filter driver technology are studied. Among them, three key problems are emphatically studied: the problem of getting the disk physical file sector address in the disk filter drive. The problem of obtaining the cluster list of the physical files in the system and the problem of establishing the corresponding relationship between the cluster address and the sector address of the file are discussed. On the basis of this research, the operating system solidification scheme based on the disk filter driver is realized. Realized disk and memory registry one-way data transfer, thus avoiding registry key link damage caused by registry redirection. 3. 3. This paper studies the communication mechanism of Windows kernel device and the file system filter driver technology, which solves the problem of how to obtain the exact file name when the file system filter driver is creating the file. The dispatch function of the file system filter driver is not in the same thread as the completion function, which results in the buffer failure and the problem that the file system filter driver cannot capture the rename message when the file is renamed across the volume. On the basis of this research, the operating system curing scheme based on file system filter driver. 4. 4. A detection scheme for malicious programs with low miss detection rate is proposed. This scheme uses Windows hook technology to extract the running sequence of the program, and carries on the abstract processing, takes this as the program characteristic, reduces the content of redundant information in the feature, and innovatively introduces the k-gram algorithm which is originally used to calculate the similarity degree. Compared with other detection schemes using SVM classification algorithm, the calculation results of this algorithm are input as SVM classification algorithm, which not only reduces the vector dimension input, but also improves the computational efficiency of the detection scheme. Moreover, the lowest rate of missing detection was 1.91%.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP316.7;TP393.08

【参考文献】