| 摘要: |
| 硬件虚拟化Rootkit(hardware virtualization-based Rootkit,简称HVBR)是近几年出现的新型恶意程序,相比传统Rootkit 具有更强的隐藏性,难以被有效地检测出来.分析了HVBR 的隐藏原理和运行机制,针对HVBR能够绕过直接内存扫描的隐藏特性,提出了一种基于物理内存搜索的检测方法.该方法通过修改页表项PTE 遍历物理内存,通过比较HVBR 的固有特征进行检测和定位.实验结果表明,该方法具有较好的可靠性和检测效率. |
| 关键词: 硬件虚拟化 HVBR(hardware virtualization-based Rootkit) 物理内存搜索 检测 |
| DOI： |
| 分类号: |
| 基金项目:国家自然科学基金(60903220) |
|
| Approach for Hardware Virtualization-Based Rootkit Detection via Physical Memory Searching |
|
ZHOU Tian-Yang, ZHU Jun-Hu, LI He-Shuai, WANG Qing-Xian
|
|
Institute of Information Engineering, PLA Information Engineering University, Zhengzhou 450002, China
|
| Abstract: |
| Hardware Virtualization-Based Rootkit (HVBR) is one of many new malwares appearing over the years. Compared to the traditional Rootkit, HVBR is stealthier and more difficult to detect. This paper analyzes the concealment and working mechanism of HVBR. By aiming at the stealth of HVBR on bypassing virtual memory scan to counter detection, this paper proposes a detection approach, based on physical memory search. The approach modifies Page Table Entry (PTE) to traverse the physical memory, and matches the fixed characteristic of HVBR with the raw memory data to detect and locate HVBR in memory. The experimental results show it is reliable and efficient. |
| Key words: hardware virtualization HVBR (hardware virtualization-based Rootkit) physical pages search detection |
