基于文件系统异常的内核级Rootkit检测
기우문건계통이상적내핵급Rootkit검측
Detecting kernel-level Rootkit based on filesystem anomalies
  • 万方数据
    计算机应用研究 계산궤응용연구
    APPLICATION RESEARCH OF COMPUTERS
    2009年 8期 3056-3057,3062 ,共3页

    刘哲元%戴冠中%王晓伶

    류철원%대관중%왕효령

    内核级Rootkit%文件系统异常%硬链接数%总块数 內覈級Rootkit%文件繫統異常%硬鏈接數%總塊數
    내핵급Rootkit%문건계통이상%경련접수%총괴수
    kernel-level Rootkit%filesystem anomalies%hard link count%total block count
    分析现有的两类Rootkit检测方法.根据内核级Rootkit在系统中的隐藏机制,提出了一种基于文件系统异常的有效检测方法.实验表明,该方法能够简便快捷地检测出内核级Rootkit的存在,帮助系统管理员进一步维护系统安全.
    분석현유적량류Rootkit검측방법.근거내핵급Rootkit재계통중적은장궤제,제출료일충기우문건계통이상적유효검측방법.실험표명,해방법능구간편쾌첩지검측출내핵급Rootkit적존재,방조계통관리원진일보유호계통안전.
    This paper analyzed the existed methodologies to detect Rootkit.According to the hiding mechanism of kernel-level Rootkit in the operating system, proposed an effective detecting method based on filesystem anomalies. The experiment indicates that it can detect the existence of kernel-level Rootkit in a simple process and help system administrators further maintain security.
    원문보기 원문다운로드 사이트로이동
저자의 최근 논문