基于x86平臺可執(zhí)行代碼動態(tài)檢測技術(shù)的研究

1、北京工業(yè)大學(xué)碩士學(xué)位論文基于X86平臺可執(zhí)行代碼動態(tài)檢測技術(shù)的研究姓名：趙彤申請學(xué)位級別：碩士專業(yè)：計算機應(yīng)用技術(shù)指導(dǎo)教師：王全民20080401AbstractAbstractWiththerapiddevelopmentofInternetthesecurityproblemismoresignificantTheattackers’exploithassomenewfeatures，whichhavelessscaleandmor

2、epertinentinsteadoflargerangeandaimlessNowadays，thecomputerisattackedbymanyexploitswhichincludeRootkitTheexistingdetectiontechnique，forexampleIDS，maybeCannotdetectkernelmodeRootkitTllispaperexpatiatestheprincipleandcorre

3、lativetheoriesofRootkitfurthermoreintroducestheissuesofRootkitdetectionItalsoexplainthetechnologyofRootkitindetailThemainfeatureofRootkitishidinginformationsuchasprocess，serviceTcp／IpportfileregistryandSOonRootkitusesDLL

4、infection，APIhooking，threadinjectionandkerneldatamanipulationtohideinformationThispaperintroducessometechnologyandtoolsofdetectingRootkitBytheanalysisofdetectionofRootldtandthefeaturesofEPA，thispapergivesadesignofRootldt

5、detectionsystembasedonx86AlsoitgivesparticularexplanationontheframeworkandfeatureofthesystemBycountingsystemcall，itCandetectwhethersystemiscompromisedTherearesomeresultsofexperimentsto謝黟theeffectThereisalsoanalysisandexp

6、lainfortheexperimentdataBycountingthesystemcall，weCalldetectwhetherthecomputeriscompromisedItgivesnecessarynarrationaboutresultdatawhichisincludedfrommanyexperimentsTheflowofthesystemtakesonasfollow：Firstofall，kernelproc

7、esssetstheTFbitandgoesintodebugmodeAndthenitdetectsfilesfunctionoftargetsystemAlsothefunctionsofprocess，registrytable，systemserviceanddriversarecheckedonebyoneTheresultwillbecomparedwimrawdata，nlewarningwillbesentifthedi

8、fferencesexceedthevalvevalueLastbutnotleast，thesummarizationofthepaperputsforwardthecurrentoftheRootldtdetectionsystemThispaperaccomplishesthreemajortasksFirstlythepaperintroducedsomebackgroundinformationaboutnetworksecu

9、rityandthetheoryandtechnologyofRootkitSecondlyitelaborateshowtoimplementsinstructioncountingandexecutivepathanalysisLastbutnotleast，itdesignsandealTiesouttheframeworkofthedetectingsystemTherearesometestsonmajormodulesKey