【作者】 孙飞；

【导师】 丁宇新； 王辉；

【作者基本信息】 哈尔滨工业大学 ， 工程硕士（专业学位）， 2020， 硕士

【摘要】 如今,不管是在个人计算机还是服务器上,Windows操作系统已经无处不在。与Windows操作系统如影随形的是各种恶意代码,这其中Rootkit以隐遁攻击严重危害到系统和用户数据安全。Rootkit可以通过隐藏自身在系统中的信息来持久的生存于受害系统中,也使得它可以躲避安全防护软件的查杀。Rootkit要隐藏的首要目标是自身进程,通过检测隐藏进程就能检测到Rootkit。但已有的检测隐藏进程的方法要么存在被Rootkit规避的途径,要么检测耗时过长致检测效率低。本文在对各种Rootkit案例进行总结后,给出了Rootkit攻击的形式化表示和使攻击成功的根本原因。然后提出多进程视图对比检测模型,并定义了可信进程视图必须满足的两个约束。基于该检测模型,提出两种新的在内核层获取进程视图的方法,以构建虚拟进程视图和物理进程视图,并与用户层进程视图进行差异分析来检测隐藏进程。虚拟进程视图依赖的是由对象管理器统一创建和维护的分发器对象。对象管理器为每个分发器对象分配内存时都带有额外的管理结构,其中保存着Pool Tag。在分发器对象的整个生命周期内,Pool Tag都不会改变。使用Pool Tag搜索法的六条搜索规则在系统非换页内存池的已分配页面中搜索分发器对象。然后从这些分发器对象与进程结构的引用关系中,找到使用它们的进程,从而构建虚拟进程视图。为了对抗采用内存视图伪装技术的Rootkit对虚拟进程视图的篡改,还通过在物理内存中搜索页目录页面来构建物理进程视图。页目录页面是操作系统在创建进程的时候为进程分配的第一个物理页面,直到进程结束才会被回收。每个进程都必然有且仅有一个页目录页面,并且对页目录页面的篡改将导致系统崩溃蓝屏,因此通过页目录页面构建的物理进程视图是可信进程视图。在物理内存中搜索到页目录页面后,再通过页目录页面找到进程的超空间页面和工作集页面,然后搜索到进程环境块所在页面,最后恢复进程语义信息。最后本文实现了一个Rootkit检测系统。并通过对Pool Tag、页目录页面和PEB进行防篡改实验,验证了物理进程视图可以抵御Rootkit的规避攻击。最后通过进程视图生成时间实验和Rootkit检测实验,验证了本文检测系统可以检测到常见的Rootkit,有着很高的检测成功率和效率。更多还原

【Abstract】 At present,Windows operating system is running on most personal computers and servers.But it never get rid of the bad influence of all kinds of malicious code including Rootkit.Rootkit can hide itself to live in the system for a persistent time.It also can escape from scanning of the security software.Its first target is to hide process.So we can detect Rootkit by detecting hidden process.Current methods to detect hidden process can be bypassed by Rootkit.And they are time comsuming.This thesis first analyzes some Rootkit samples and generalizes its formal principle.Then it proposes a multi process view comparing modal and defines two constraints to be satisfied by a trusted process view.Based on this modal the differences between virtual process view,physical process view and user process view can be used to detect hidden process.Virtual process view is built from dispatcher objects which are managed by object manager.Each memory block allocated for a dispatcher object has a Pool Tag.The Pool Tag won’t change in the whole life of dispatcher objects.All dispatcher objects can be found by searching Pool Tag in all allocated pages of Non Paged Pool.Then the ower process can be found from dispatcher objects.Some Rootkits may subvirt the virtual process view.A trusted physical process view is built by searching page directory page in physical memory.Windows operating system will allocate a page directory page when creating a process and release it when process exits.Any tampers with the page directory page will cause system crash.After found the page directory page,the hyper space page,and working set page and then PEB page can be found consequently.The process symantic can be recovered from PEB finally.In the end this thesis demenstrates a Rootkit detection system.The physical process view is tamper resistant to Rootkit through anti tamper experiments on Pool Tag,page directory page and PEB.And the experiments on building process view and detecting Rootkits shows it can detect well known Rootkits with a very high success rate and efficiency.更多还原