CAJ | 학술논문

Bootkit 这种新型恶意代码通过感染磁盘的主引导记录（MBR）或卷引导记录（VBR）来获取执行权，从而将加载时间大大提前以使常规基于动态行为分析的安全软件都不能对其进行有效检测[1]。针对 Bootkit 检测这一难题提出一种新型静态检测方法，设计实现相关的 MBR 匹配算法，并针对国内外知名的 Bootkit 恶意代码样本进行实验。实验结果显示此方法可以有效检测出当今主流的 Bootkit 恶意代码，进而证明了静态检测思路的可行性。
Bootkit 저충신형악의대마통과감염자반적주인도기록（MBR）혹권인도기록（VBR）래획취집행권，종이장가재시간대대제전이사상규기우동태행위분석적안전연건도불능대기진행유효검측[1]。침대 Bootkit 검측저일난제제출일충신형정태검측방법，설계실현상관적 MBR 필배산법，병침대국내외지명적 Bootkit 악의대마양본진행실험。실험결과현시차방법가이유효검측출당금주류적 Bootkit 악의대마，진이증명료정태검측사로적가행성。
Bootkit,a novel malicious code,grabs the right of execution by infecting MBR or VBR so that greatly advances the loading time thus disables the effective detection on it by the conventional security software based on dynamic behaviour analysis[1].We propose a novel static detection method in this paper aiming at such a difficulty of Bootkit detection,design and implement correlated MBR matching algo-rithm.Moreover,the experiment is carried out against the Bootkit malicious code sample well-known at home and abroad.Experimental re-sults show that this method can effectively detect today’s mainstream Bootkit malicious codes,and further proves the feasibility of static detec-tion idea.