以 SSDT Hooking 為基礎之掃毒軟體保護機制;A SSDT Hooking-based Mechanism to Protect Antivirus Software

NCUIR > College of Electrical Engineering & Computer Science > Department of Computer Science and information Engineering > Research Project > Item 987654321/62991

Please use this identifier to cite or link to this item: http://ir.lib.ncu.edu.tw/handle/987654321/62991

Title:	以 SSDT Hooking 為基礎之掃毒軟體保護機制;A SSDT Hooking-based Mechanism to Protect Antivirus Software
Authors:	許富皓;黃燕鈴
Contributors:	國立中央大學資訊工程系
Keywords:	資訊科學;軟體
Date:	2013-12-01
Issue Date:	2014-03-17 14:16:14 (UTC+8)
Publisher:	行政院國家科學委員會
Abstract:	研究期間：10208~10307;In the near several decades, the arms race between malware writers and antivirus programmers has become more and more severe. The simplest way for a computer user to secure her/his computer is to install antivirus software on her/his computer. As antivirus software becomes more sophisticated and powerful, evading the detection of antivirus software becomes an important part of malware. As a result, malware writers have developed various approaches to increase the survivability and stealth of their malware. One of these technologies is to terminate antivirus software right after the execution of the malware. In this project, we plan to propose a mechanism, called ANtivirus Software Shield (ANSS), to prevent antivirus software from being terminated without the consciousness of the antivirus software users. ANSS uses SSDT (System Service Descriptor Table) hooking to intercept specific Windows APIs and analyzes them to filter out hazardous API calls that will terminate antivirus software. After implementing our system, we will use diverse pieces of malware that can terminate various brands of antivirus applications to test the effectiveness of ANSS and the performance overhead of ANSS.
Relation:	財團法人國家實驗研究院科技政策研究與資訊中心
Appears in Collections:	[Department of Computer Science and information Engineering] Research Project

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	351	View/Open

社群 sharing

Loading...