全部 标题 作者
关键词 摘要

OALib Journal期刊
ISSN: 2333-9721
费用:99美元

查看量下载量

相关文章

更多...

面向恶意软件分析及保护的文件系统

DOI: 10.13190/jbupt.201103.58.lianghl, PP. 58-61

Keywords: 恶意软件,文件系统,版本化,钩子,恢复

Full-Text   Cite this paper   Add to My Lib

Abstract:

为应对危害日益严重的恶意软件,提出在文件系统层对恶意软件进行分析和防御,并尽可能减少其影响的方法,设计实现了面向恶意软件分析和保护的文件系统(MAPFS).该系统通过文件版本化技术和钩子技术,可记录1个进程在其生命过程中对文件系统的一系列修改.这些行为记录可作为分析恶意软件的重要依据,也可用于对被破坏的重要文件进行恢复保护.实验结果表明,该方法可有效用于恶意软件的分析及保护,MAPFS在性能方面的影响低于10%.

References

[1]  Economics C. 2007 malware report: the economic impact of viruses, spyware, adware, botnests and other malicious code. Tech Rep, 2007.
[2]  Hex-Rays D. SA/NV. IDA Pro disassembler and debugger. (2010).
[3]  Dinaburg A, Royal P, Sharif M I, et al. Ether: malware analysis via hardware virtualization extensions//ACM CCS 2008. New York: ACM, 2008: 51-62.
[4]  Barham P, Dragovic B, Fraser K, et al. Xen and the Art of Virtualization//SOSP2003. Bolton Landing: , 2003: 164-177.
[5]  Moser A, Kruegel C, Kirda E. Limits of static analysis for malware detection//ACSAC 2007. Miami Beach:, 2007: 421-430.
[6]  Bayer U, Moser A, Kruegel C, et al. Dynamic analysis of malicious code[J]. J Comput Virol, 2006, 2(1): 67-77.
[7]  Moser A, Kruegel C, Kirda E. Exploring multiple execution paths for malware analysis//SP07. Berkeley:, 2007: 231-245.
[8]  Ferrie P. Attacks on virtual machine emulators//AVAR2006. Auckland:,2006: 128-143.
[9]  Garfinkel T, Adams K, Warfield A, et al. Compatibility is not transparency: VMM detection myths and realities//USENIX HotOS2007. San Diego: , 2007:1-6.
[10]  Azagury A, Factor M E, Satran J. Point-in-time copy: yesterday, today and tomorrow//MSST02. Maryland: , 2002: 259-270.
[11]  Muniswamy-Reddy K K, Wright C P, Himmer A, et al. A versatile and user-oriented versioning file system//FAST04. Francisco: , 2004: 115-128.
[12]  Henk C. Filesystem in user space. (2010) .

Full-Text

Contact Us

service@oalib.com

QQ:3279437679

WhatsApp +8615387084133