- 學位論文
一個針對掛鉤式Rootkits 的有效解決方式
An Efficient Solution for Hook-Based Kernel Level Rootkits
若您是本文的作者，可授權文章由華藝線上圖書館中協助推廣。
摘要
在現今的Windows XP作業系統當中，已經存在許多的軟體(例如： Rootkit Unhookers, Rootkit Hook Analyzer)可以檢查出是否有 驅動程式掛鉤在Kernel mode中的System Service Dispatch Table 上，甚至對此表格還原。然而，即使現有的研究已經具備足夠偵測 掛鉤並且還原的能力，但是，如何真正的判定一個掛鉤為惡意或是 非惡意的判斷研究卻是非常的少。假使一個使用者在利用了前面所 提及的軟體後，發現有驅動程式掛鉤在System Service Dispatch Table上，而若此驅動程式是一個非惡意的掛鉤，當使用者貿然移 除了這個掛鉤，即有可能導致某些程式的無法使用，或甚至造成藍 畫面。有鑒於此，我們在檢驗出系統存在掛鉤之後，判斷其是否為 惡意。當一個驅動程式修改了某些原生API的參數傳遞時，則此驅 動程式極有可能為惡意，而我們提出的方法，能夠以不影響系統的 正常運作之情況下，針對驅動程式是否為惡意作更深一層的分析。
並列摘要
It is easy to discover if there are hooks in the System Service Dispatch Table (SSDT). However, it is difficult to tell whether theses hooks are malicious or not after finding out the hooks in the SSDT. Thus, we observe the behavior of these hooks by re-calling the original Native API and examine the results in order to make a better decision. When the users inspect their computers by existing tools (e.g., Rootkit Unhookers, Rootkit Hook Analyzer) and find out some hooks, they do not know what to do next because honest softwares (e.g., Anti-Virus Software, On-Line-Game) may also hook SSDT. In this paper, we propose a scheme that evaluates the hooks by comparing the returned results before and after hooked. Through this comparison, if a malicious hook which hides itself by the way of modifying the parameters passed to the Native API, we can easily detect this difference. Furthermore, we use a runtime detour patching technique so that it will not perturb the normal operation of user-mode programs. Finally, we discuss the existing approaches of rootkits detection both user-mode and kernel-mode. Our method effectively monitors the behavior of hooks and brings an accurate view point for users to examine their computers.
參考文獻
[37] J. Rutkowska. Thoughts about Cross-View Based Rootkit Detection. http://invisiblethings.org, 2005.
[1] P. Akritidis, E. Markatos, M. Polychronakis, and K. Anagnostakis. Stride: Polymorphic sled detection through instruction sequence analysis. 20th IFIP International Information Security Conference, 2005.
[4] E. Barrantes, D. Ackley, S. Forrest, T. Palmer, D. Stefanovic, and D. Dai Zovi. Randomized Instruction Set Emulation to Disrupt Binary Code Injection Attacks.
[17] R. Jeffrey. Load Your 32-bit DLL into Another Process's Address Space Using INJLIB. Microsoft Systems Journal, 9(5), May 1994.
[18] X. Jiang, X. Wang, and D. Xu. Stealthy Malware Detection through VMM-Based "Out-of-the-Box" Semantic View Reconstruction. In Proceedings of the 14th ACM conference on Computer and communications security, pages 128-