基于内核驱动的恶意代码动态检测技术

通过对Windows下的代码注入方法和Hook技术的详尽分析与研究,提出了一种基于内核驱动的恶意代码动态检测方法. 该方法采用驱动的方式运行于系统内核中,在不影响系统性能的前提下,动态监控系统中所有进程,同时及时准确地向用户报告任何攻击信息,增强了系统的整体安全性. 实验结果表明,该方法在性能和检测方面都达到较好的检测效果.

Detection of the malicious code injection by hooking system calls in kernel mode

Based on detailed analyses of all the methods about runtime process injection and hooking techniques in Windows operating system, we propose a method for dynamically detecting malicious code using the kernel-mode driver. It is implemented as a driver that is able to dynamically monitor every process, report attacks to the user accurately, and enhance overall system security.The experimental results show that this method achieves satisfactory detection effects in performance and detection.