Antivirus software shield against antivirus terminators

NCUIR > College of Electrical Engineering & Computer Science > Department of Computer Science and information Engineering > journal & Dissertation > Item 987654321/106301

Please use this identifier to cite or link to this item: https://ir.lib.ncu.edu.tw/handle/987654321/106301

Title:	Antivirus software shield against antivirus terminators
Authors:	許富皓;Hsu, Fu-Hau;Wu, Min-Hao;Tso, Chang-Kuo;Hsu, Chi-Hsien;Chen, Chieh-Wen
Contributors:	資訊電機學院資訊工程學系
Keywords:	Anti-virus software;Antivirus software;API;API hooking;Computer information security;Computer programs;Computer viruses;Computers;Cybersecurity;Malware;Materials;Process control;Programmers;Reverse engineering;Shields;Software;Tables (data)
Date:	2012-09-20
Issue Date:	2026-04-23 13:17:05 (UTC+8)
Publisher:	Institute of Electrical and Electronics Engineers Inc.;New York: IEEE
Abstract:	摘要： In the last several decades, the arms race between malware writers and antivirus programmers has become more and more severe. The simplest way for a computer user to secure his computer is to install antivirus software on his computer. As antivirus software becomes more sophisticated and powerful, evading the detection of antivirus software becomes an important part of malware. As a result, malware writers have developed various approaches to increase the survivability and concealment of their malware. One of these technologies is to terminate antivirus software right after the execution of the malware. In this paper, we propose a mechanism, called ANtivirus Software Shield (ANSS), to prevent antivirus software from being terminated without the consciousness of the antivirus software users. ANSS uses System Service Descriptor Table (SSDT) hooking to intercept specific Windows APIs and analyzes them to filter out hazardous API calls that will terminate antivirus software. When using several pieces of malware that can terminate various brands of antivirus applications to make our experiments, the results show that ANSS can protect antivirus software from being terminated by them with at most 0.42% CPU performance overhead and 1.77% memory write performance overhead. 其他題名： TIFS 出版者： New York: IEEE 出版日期： 2012-10-01 出處： IEEE Transactions on Information Forensics and Security, 2012-10, Vol.7 (5), p.1439-1447 資源來源： IEEE Electronic Library (IEL) 版權： Copyright The Institute of Electrical and Electronics Engineers, Inc. (IEEE) Oct 2012 識別號： ISSN: 1556-6013 識別號： EISSN: 1556-6021 識別號： DOI: 10.1109/TIFS.2012.2206028 識別號： CODEN: ITIFA6
Appears in Collections:	[Department of Computer Science and information Engineering] journal & Dissertation

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	19	View/Open

社群 sharing

Loading...