Attacking control method for protecting kernel system

Abstract

The invention discloses an attacking control method for protecting a kernel system. The attacking control method includes the step 101 that an active trapping system is set up in pre-defense in a network defense system, an attacking control engine of the trapping system is arranged in the kernel system, and an attacking detection engine, an analysis engine and a control engine are set up in the kernel system of an operating system of a computer to detect and control act information, the step 102 that information from the step 101 is obtained through the attacking control engine arranged in the kernel system, and the attacking control engine can prevent files in a kernel from being maliciously attacked and replaced, prevent running of malicious acts and utilization of the functions of the malicious acts and finally uninstall the malicious acts from the kernel system, and the step 103 that the process is ended. According to the attacking control method, whether acts are control acts or not can be judged, and the malicious control acts can be timely blocked by conducting fine-grained searching and killing such as pilot system file protection check, loading system file protection check, drive module protection check and hardware supporting module protection check, and security and credibility of the kernel system are ensured.

Description

technical field [0001] The invention specifically relates to an attack control method for protecting a kernel system, which is used for controlling attackers' controlling malicious behavior on key positions of the kernel system, and protecting a trapping computer from attacking other internal real servers. Background technique [0002] Nowadays, with the wide application of network technology, network attack incidents emerge in an endless stream, and network security has become the focus of today's research hotspots and social concerns. Existing network security technologies with firewalls and intrusion detection systems (IDS) as the core defense technologies usually lag behind. in a variety of attack techniques. As a new network security technology, honeypot technology has gradually attracted people's attention. It adopts a proactive approach, attracts attackers with its unique features, and at the same time analyzes various attack behaviors of attackers and finds effecti...

AI Technical Summary

Problems solved by technology

[0004] Although the honeypot technology can make up for the deficiencies of the original passive security defense with the cooperation of security measures such as network firewalls and intrusion detection systems, it still has some insurmountable shortcomings: traditional data control technology only transfers data entering the honeypot system Record or modify without the ability to identify the data itself, which greatly reduces the security of protecting the core system

Images