一种基于行为的RootKit检测方法

介绍了RootKit技术的基本原理以及对于RootKit的常用检测方法,分析了RootKit的主要行为,提出了基于行为的RootKit检测方法.     

Windows RootKit检测与取证技术研究

文章首先对近几年来Windows RootKit检测技术的发展和研究进行了描述,接着对当前常用的RootKit检测工具及其检测方法做了介绍,进而探讨了Windows RootKit的取证与分析方法,以期对当前计算机取证人员有效解决Windows RootKit检测和取证提供一些借鉴。     

轻松击碎RootKit的隐身重甲

RootKit后门程序(例如"黑客守护者")利用了操作系统的模块化技术,将自身作为系统内核的一部分来运行。和普通的木马后门相比,具有强大的功能和隐蔽性。从RootKit的运行特点说,它可以隐藏进程信息、用户信息、系统服务、注册表主键和键值,还能开启远程Shell,截取键盘输入信息,查看和结束进程,重启系统。面对几乎堪称完美的RootKit后门,难道我们就真的束手无策了吗?     

基于Windows NT过滤驱动键盘录入信息保护

随着电子商务的发展和网上银行系统的应用日益广泛,并且伴随RootKit技术的日益成熟,针对这些应用系统的信息窃取行为也日益增多,恶意软件的检测变得更加困难。本文在网上银行系统键盘保护模块设计方案的基础上,提出针对目前流行的RootKit检测方法的一种比较完善的键盘录入信息保护策略。该保护方案以一种安全可靠的键盘录入信息方式很好地保护用户输入信息,以达到更好的信息安全保护效果。     

RotKit在Linux下的工作原理及其检测

该文介绍了RootKit的相关概念以及它给计算机系统与网络安全带来的威胁,并分析了RootKit的分类方式及其各类RootKit的工作原理和实现方法.最后针对不同类型的RootKit,给出了相应的检测、清除及防范手段.     

RootKit在Linux下的工作原理及其检测

该文介绍了RootKit的相关概念以及它给计算机系统与网络安全带来的威胁,并分析了RootKit的分类方式及其各类RootKit的工作原理和实现方法。最后针对不同类型的RootKit,给出了相应的检测、清除及防范手段。     

基于NT内核操作系统的RootKit的实现

介绍了Windows NT平台下RootKit实现的基本原理及步骤,探讨了在Windows平台下进行Ring0级编程的实现及如何修改安全参考监视器来彻底突破NT的安全防御系统,并给出了整个RootKit的部分核心汇编源代码。     

抓捕Root Kit病毒

这天，当笔者想使用IceSword对系统进行检测时，发现该工具无法运行了，原因是在其运行目录中找不到主程序“icesword．exe”。笔者重新下载了IceSword，但是依然找不到主程序，看来，是有恶意程序使用RootKit技术，从系统底层隐藏了IceSword主程序。那么什么是RootKit病毒，又该如何将其彻底清除呢？本文将从多个角度对此进行细致分析。     

基于HSC的进程隐藏检测技术

介绍了目前Windows下常见的进程隐藏检测技术,提出了基于截获系统调用（HSC)的进程隐藏检测技术,利用隐藏进程的行为特征,通过截获系统调用建立完整的进程列表来检测隐藏进程,并针对该技术对抗RootKit的攻击提出了改进。该种隐藏进程的检测方法十分可靠,可以检测出常规安全检测工具不能发现的系统恶意程序。     

“文件夹隐藏者”病毒的分析与处理

据反病毒专家介绍,文件夹隐藏者(Trojan)病毒系采用RootKit技术隐藏自身进程的木马。该木马采用Delphi工具编写,以使自己可以与系统一起运行,病毒主要感染Win NT以上的WINDOWS操作系统。该木马文件最大的隐蔽之处就是会遍历硬盘或U盘里面的文件夹,并且将原来的文件夹隐藏起来。     

Only connect: teaching, technology and telesis

Abstract This paper describes an approach to the design of interactive multimedia materials being developed in a European Community project. The developmental process is seen as a dialogue between technologists and teachers. This dialogue is often problematic because of the differences in training, experience and culture between them. Conditions needed for fruitful dialogue are described and the generic model for learning design used in the project is explained.     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

Avoiding semantic and temporal gaps in developing software intensive systems

Development of software intensive systems (systems) in practice involves a series of self-contained phases for the lifecycle of a system. Semantic and temporal gaps, which occur among phases and among developer disciplines within and across phases, hinder the ongoing development of a system because of the interdependencies among phases and among disciplines. Such gaps are magnified among systems that are developed at different times by different development teams, which may limit reuse of artifacts of systems development and interoperability among the systems. This article discusses such gaps and a systems development process for avoiding them.     

Designing economic np control charts: A programmed simulation approach

This paper presents control charts models and the necessary simulation software for the location of economic values of the control parameters. The simulation program is written in FORTRAN, requires only 10K of main storage, and can run on most mini and micro computers. Two models are presented - one describes the process when it is operating at full capacity and the other when the process is operating under capacity. The models allow the product quality to deteriorate to a further level before an existing out-of-control state is detected, and they can also be used in situations where no prior knowledge exists of the out-of-control causes and the resulting proportion defectives.     

煤矿井下安全监控分站的设计及其仿真实现

为了设计一种具有低成本、低功耗、易操作、功能强且可靠性高的煤矿井下安全分站,针对煤矿安全生产实际,文章提出了采用MCS-51系列单片机为核心、具有CAN总线通信接口的煤矿井下安全监控分站的设计方案;首先给出煤矿井下安全监控分站的整体构架设计,然后着重阐述模拟量输入信号处理系统的设计过程,最后说明单片机最小系统及其键盘、显示、报警、通信等各个组成部分的设计;为验证设计方案的可行性与有效性,使用Proteus软件对设计内容进行仿真验证,设计的煤矿井下安全监控分站具有瓦斯、温度等模拟量参数超标报警功能和电机开停、风门开闭等开关量指示功能;仿真结果表明:设计的煤矿井下安全监控分站具有一定的实际应用价值.     

The development of robot art

Going through a few examples of robot artists who are recognized worldwide, we try to analyze the deepest meaning of what is called “robot art” and the related art field definition. We also try to highlight its well-marked borders, such as kinetic sculptures, kinetic art, cyber art, and cyberpunk. A brief excursion into the importance of the context, the message, and its semiotics is also provided, case by case, together with a few hints on the history of this discipline in the light of an artistic perspective. Therefore, the aim of this article is to try to summarize the main characteristics that might classify robot art as a unique and innovative discipline, and to track down some of the principles by which a robotic artifact can or cannot be considered an art piece in terms of social, cultural, and strictly artistic interest. This work was presented in part at the 13th International Symposium on Artificial Life and Robotics, Oita, Japan, January 31–February 2, 2008     

Explanation and prediction: an architecture for default and abductive reasoning

Although there are many arguments that logic is an appropriate tool for artificial intelligence, there has been a perceived problem with the monotonicity of classical logic. This paper elaborates on the idea that reasoning should be viewed as theory formation where logic tells us the consequences of our assumptions. The two activities of predicting what is expected to be true and explaining observations are considered in a simple theory formation framework. Properties of each activity are discussed, along with a number of proposals as to what should be predicted or accepted as reasonable explanations. An architecture is proposed to combine explanation and prediction into one coherent framework. Algorithms used to implement the system as well as examples from a running implementation are given.     

Three Process Perspectives: Organizations, Teams, and People

This paper provides the author's personal views and perspectives on software process improvement. Starting with his first work on technology assessment in IBM over 20 years ago, Watts Humphrey describes the process improvement work he has been directly involved in. This includes the development of the early process assessment methods, the original design of the CMM, and the introduction of the Personal Software Process (PSP)^SM and Team Software Process (TSP){^SM}. In addition to describing the original motivation for this work, the author also reviews many of the problems he and his associates encountered and why they solved them the way they did. He also comments on the outstanding issues and likely directions for future work. Finally, this work has built on the experiences and contributions of many people. Mr. Humphrey only describes work that he was personally involved in and he names many of the key contributors. However, so many people have been involved in this work that a full list of the important participants would be impractical.     

基于复小波噪声方差显著修正的SAR图像去噪

提出了一种基于复小波域统计建模与噪声方差估计显著性修正相结合的合成孔径雷达(Synthetic Aperture Radar,SAR)图像斑点噪声滤波方法。该方法首先通过对数变换将乘性噪声模型转化为加性噪声模型,然后对变换后的图像进行双树复小波变换(Dualtree Complex Wavelet Transform,DCWT),并对复数小波系数的统计分布进行建模。在此先验分布的基础上,通过运用贝叶斯估计方法从含噪系数中恢复原始系数,达到滤除噪声的目的。实验结果表明该方法在去除噪声的同时保留了图像的细节信息,取得了很好的降噪效果。