Dissertation > Excellent graduate degree dissertation topics show

Hidden Process Technique and Its Application in the Malicious Code Detection

Author: ZhangDeCheng
Tutor: MaChunGuang
School: Harbin Engineering University
Course: Applied Computer Technology
Keywords: process hide Rootkit malicious code detection
CLC: TP393.08
Type: Master's thesis
Year: 2012
Downloads: 81
Quote: 0
Read: Download Dissertation

Abstract


Along with the rapid development of the Internet technology, people are paying moreand more attention to network security. Viruses and Trojan were no longer simply aimed atdamaging the system and showing off their technologies, but sneaking into system to hidethemselves, collecting data and damaging the system to extract money. In order to avoiddetection, backdoors adopt technologies to hide themselves, among which process-hiding isthe most basic one.The current situation of Rootkit was presented, followed by the Rootkits’ workingprinciple including API hooking, system memory modification and kernel objectmanipulation. IAT Hook and Inline Hook under user mode, IDT Hook, SSDT Hook andDirect Kernel Object Manipulation (DKOM) under kernel mode were analyzed in this paper.Furthermore, several classical Rootkit detection tools targeted to specific objects werepresented.Based on analysis of process-hiding technologies used by Rootkit, a multilayer andmutimethod hidden-process-detecting system with perfect self-integrity protecting functionwas designed. This system can prevent detection system from malicious codes’ attack anddetect the Rootkit both on user mode and kernel mode, in which the Rootkit may bemodified. On user mode, detection system employs kernel function call; on kernel mode,memory scanning based hook detection, process list based detection, thread list baseddetection and thread dispatch based detection are used, malicious code can’t cope with somany detection methods, and make the objects designed universal and efficient. Moreover,hidden-process treatment was realized by analyzing process management on kernel mode.Finally, the system was analyzed by VS2005and tested by a serial of experiments, and thesystem achieved the expected results.

Related Dissertations

  1. Signal Detection Circuit Design for Slow-Light Optic Fiber Gyroscope,V241.5
  2. Realization of Fiber Optic Gyroscope Signal Processing Circuits Based on FPGA,V241.5
  3. Research on Automatic Detection Algorithm for Substructure Distress of Highway Pavement Based on SVM,U418.6
  4. Research on Dam-Break Probability Analysis Method for Dangerous Reservoir,TV697
  5. Well Detection Pump Steady-Speed Driving System of Brushless DC Motor,TM33
  6. Study on the Echo Processing Method for the Measurement of Wire Length Based on Pulsereflection,TM247
  7. Research on Fault Detection and Network Reconfiguration Algorithms for Distribution Network,TM727
  8. Construction and improvement of basic education reform process evaluation platform,G521
  9. Implementation Study of evaluation method of the high school IT courses,G633.67
  10. The Matlab Implementation of Joint Source and Channel Decoding of Turbo Code Based on Meanmatch,TN911.22
  11. Research on Autamatic Music Structrue Analysis,TN912.3
  12. Research on 8 Mm-Band Direct Detection Radiometer,TN850.7
  13. Study of Target Simulation and Signal Processing Algorithm for Skywave Over-The-Horizon Radar,TN958.93
  14. Research of Image Mosaic Technology,TP391.41
  15. The Fatigue State Recognition of the Driver Based on Eye Detection,TP391.41
  16. Research on Joint Target Detection for Dual-Sensor Image and System Implementation,TP391.41
  17. The Design and Implementation of Security Mechanism of Embedded Dependable Computer,TP309
  18. Research on Evaluation of Simulation Systems Based on Fidelity,TP391.9
  19. Multi-currency Notes Technology Research and Implementation,TP391.41
  20. Camera Calibration and Position and Pose Detecting on Vision Measurement System of PCB,TP391.41
  21. The Research of Moving Object Tracking System Based on Embeded Image Process Unit,TP391.41

CLC: > Industrial Technology > Automation technology,computer technology > Computing technology,computer technology > Computer applications > Computer network > General issues > Computer Network Security
© 2012 www.DissertationTopic.Net  Mobile