Kernel level rootkit detection method and system in Andriod system

Abstract

The invention discloses a kernel level rootkit detection method in an Andriod system, comprising the following steps of statically obtaining an address and a table entry of a system call table; entering into a kernel mode from a user mode; dynamically obtaining the address of the system call table; if the addresses are not matched, then generating an intrusion reporting; obtaining a pure address of the system call table; if the system call table is not matched, then generating the intrusion reporting and restoring; intercepting a module name called by a module loading function, retrieving the dynamically loaded module name, if the name is not matched, then deleting the hidden module, and generating the intrusion reporting; obtaining all the progress information actually loaded by a system to be detected, and obtaining all the progress information by using a command query, if the progress information is not matched, then eliminating the malicious processes and generating the intrusion reporting. The invention also discloses a rootkit detection system, which can detect the intruded rootkit and delete the rootkit with an illegal act, so as to improve the safety and reliability of the system.

Description

technical field [0001] The invention belongs to the technical field of computer security, and in particular relates to a kernel-level rootkit detection method in an Android system and a system thereof. Background technique [0002] With the development of information technology, smart phones have been popularized, especially mobile phones using the Android operating system platform have occupied the mainstream market. The Android system architecture is divided into Applications, Applications Framework, Libraries, Android Runtime and Linux kernel. The bottom layer of Android is the linux kernel, which directly operates hardware devices for the bottom and provides bottom-level services for the operating system, such as process scheduling, memory management, network management, and related hardware driver modules. Due to the open source code, traditional rootkit malicious programs are also Moved to Android phones and grew rapidly. Rootkit has strong concealment, can hide proc...

AI Technical Summary

Problems solved by technology

As a mobile phone system, the Android system can intercept a large amount of private information, including text messages, photos, etc., through rootkits. At present, no software tools for rootkit detection and protection that fully serve the android platform have been launched to solve such technical problems. Therefore, in order to overcome the existing The above-mentioned defect of technology, the present invention proposes a kind of kernel-level rootkit detection method and its system in Android system

Images