以 SSDT Hooking 為基礎之掃毒軟體保護機制;A SSDT Hooking-based Mechanism to Protect Antivirus Software

NCU Institutional Repository > 資訊電機學院 > 資訊工程學系 > 研究計畫 > Item 987654321/62991

請使用永久網址來引用或連結此文件: http://ir.lib.ncu.edu.tw/handle/987654321/62991

題名:	以 SSDT Hooking 為基礎之掃毒軟體保護機制;A SSDT Hooking-based Mechanism to Protect Antivirus Software
作者:	許富皓;黃燕鈴
貢獻者:	國立中央大學資訊工程系
關鍵詞:	資訊科學;軟體
日期:	2013-12-01
上傳時間:	2014-03-17 14:16:14 (UTC+8)
出版者:	行政院國家科學委員會
摘要:	研究期間：10208~10307;In the near several decades, the arms race between malware writers and antivirus programmers has become more and more severe. The simplest way for a computer user to secure her/his computer is to install antivirus software on her/his computer. As antivirus software becomes more sophisticated and powerful, evading the detection of antivirus software becomes an important part of malware. As a result, malware writers have developed various approaches to increase the survivability and stealth of their malware. One of these technologies is to terminate antivirus software right after the execution of the malware. In this project, we plan to propose a mechanism, called ANtivirus Software Shield (ANSS), to prevent antivirus software from being terminated without the consciousness of the antivirus software users. ANSS uses SSDT (System Service Descriptor Table) hooking to intercept specific Windows APIs and analyzes them to filter out hazardous API calls that will terminate antivirus software. After implementing our system, we will use diverse pieces of malware that can terminate various brands of antivirus applications to test the effectiveness of ANSS and the performance overhead of ANSS.
關聯:	財團法人國家實驗研究院科技政策研究與資訊中心
顯示於類別:	[資訊工程學系] 研究計畫

文件中的檔案:

檔案	描述	大小	格式	瀏覽次數
index.html		0Kb	HTML	327	檢視/開啟

在NCUIR中所有的資料項目都受到原著作權保護.

社群 sharing

資料載入中.....