Method and device of detection processing of core-level rootkit

Abstract

The invention discloses a method and a device of detection processing of a core-level rootkit. The method comprises the following steps of A, pre-storing a new loading module node signature at a current node of a core module chain table, and storing a current node signature into a new loading module node; B, loading a new module, judging whether the signature stored in the new loading module node is matched with the current node signature or not, judging whether the signature stored in the current node is matched with the new loading module node signature or not, if one is not matched, preforming the step C; C, comparing a currently operational system call table with a spare system call table, if not consistent, generating a report of discovering a hidden module. According to the method and the device, invasion of the rootkit is detected by setting a mutually matching mechanism of the new loading module and the current node signature of the chain table, and the report is further affirmed through comparing the system call table with a spare reference file, so that the reliability of a detection result is improved, and meanwhile, through setting a system recovery method, safety operation of the system is ensured.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a kernel-level rootkit detection and processing method and system. Background technique [0002] The number of malware in the Android system is growing rapidly, but the research on Android security is far behind. Rootkit technology is one of the main technical means used by malicious programs to hide themselves. The principle is: the system call implementation function is located in the kernel space, and the loadable kernel module can access various resources in the kernel space through the kernel symbol table, which is It is possible for the attacker to write a LKM (Loadable Kernel Modules) and use the HOOK technology to hook the system call to execute the attacker's code fragment. Existing kernel-level rootkits are implemented based on this principle. The rootkit that modifies the system call table modifies some system call function addresses located in the system call tabl...

AI Technical Summary

Problems solved by technology

[0018] In view of the above-mentioned deficiencies in the prior art, the object of the present invention is to provide a kernel-level rootkit detection and processing method and system, aiming to solve the problem that the current Android system cannot detect kernel-level rootkits well and perform system recovery

Images