基於DKOM-Rootkit之即時防禦機制

隨著電腦在各行各業的普及、普遍下，許多重要訊息大量的儲存於電腦系統中和用於網路中傳輸，而系統安全的研究議題也成為熱門研究方向。由於現在的網路以及操作系統存在很多安全漏洞在，因此操作系統很容易遭受各式各樣的攻擊，其中被廣泛使用的一種技術就是Rootkit。Rootkit的技術變化多端，如今沒有任何一家防毒能宣稱對它瞭若指掌並且百分之百抓出Rootkit，且對於未知型和複合型之Rootkit更是束手無策。本論文之研究目標是提出一種防禦與偵測Rootkit的方法。首先對Rootkit的攻擊技術進行分析，並針對DKOM-Rootkit技術做深入研究。本論文詳細描述偵測技術和防禦技巧，並分析各種偵測和防禦思路的優點與不足，從這些思路中再抽取其中技術增強並設計來抵禦DKOM-Rootkit的侵擾。為了提高此機制的速度、效能及精準度，本論文提出了一種集成的偵防思路和方法，建立在以DKOM為基底的Windows Rootkit上。透過本論文設計之機制，可以達到不錯的攔截效果，也可以精確指出隱藏的位址所在，讓Rootkit無所遁形，確保電腦系統的安全性。

關鍵字

直接內核對象修改；惡意軟件；系統安全；內核模式； Rootkit

並列摘要

With the development of computer technology widely applied in every walk of life, all kinds of important information are stored in computer and transported through Internet. So the system security has become a popular research target. As there are so many vulnerabilities exist in modern computer operating system and internet, the operating system is vulnerable to many types of attacks. One of the most popular attack techniques is Rootkit. Rootkit has a lot of technical tricks, so nowadays no one can claim their antivirus that have ability to understand it and caught Rootkit precisely. Furthermore, it is helpless for unknown Rootkit and complex-type Rootkit. The goal of this thesis is propose a defense and detection scheme on Rootkit. Analysis the attack techniques of Rootkit firstly, and do in-depth research on DKOM technology. In this thesis, a detailed description on detection technologies and defense techniques is being discussed, and then analysis the advantages and disadvantages. Finally, extract techniques from above mentioned which enhance designed to oppose Rootkit invasion. In order to improve the capability and hit rate, a new defense and detection method is proposed which is based on Windows DKOM-Rootkit. It’s not only achieve intercept but also point out the hidden address accurately by purpose mechanism. Ensure the security of computer systems.

並列關鍵字

Direct Kernel Object Manipulation ； Malware ； Rootkit ； System security ； Kernel mode

參考文獻

[29] Margaret Rouse, Rootkit, http://searchmidmarketsecurity.te chtarget.com /definition/rootkit/

[27] M. Schmidt, L. Baumgartner, P. Graubner, D. Bock, and B. Freisleben, "Malware Detection and Kernel Rootkit Prevention in Cloud Computing Environments," In Proc. Parallel, Distributed and Network-Based Processing (PDP), 19th Euro micro International, 2011.

[4] J. Zhu, T. Zhou, and Q. Wang, "Towards a Novel Approach for Hidden Process Detection based on Physical Memory Scanning," in Proc. Multimedia Information Networking and Security (MINES), 2012.

[8] LU. Zeyong, GAN. Gang, and JIANG. Jun "Analysis and .research on hidden technology based on kernel-level Rootkit process," in Proc. Internet Technology and Applications (iTAP) Aug. 2011

[14] F. Yan, and S. Liu, "Research on monitoring hiding technology in protection system," Web Society (SWS), 3rd Symposium on. IEEE, 2011.

國際替代計量

基於DKOM-Rootkit之即時防禦機制

未授權

主題瀏覽