Terminal registry security protection method and system based on windows driving technology

Abstract

The invention discloses a terminal registry security protection method and protection system based on a windows drive technology. The protection method comprises the following steps: capturing a registry request change instruction sent by an operating system; and judging whether the registry requested to be changed is a registry in the registry protection strategy to be protected or not. And whenthe registry requested to be changed is the registry in the registry protection strategy to be protected, intercepting a change operation and controlling the proxy component to send prompt informationto the user. According to the terminal registry security protection method based on the windows driving technology, a windows operating system driving mode is adopted, and a specified registry path and all sub-items are protected against tampering and deleting. Due to the fact that real-time detection can be achieved in a windows operating system driving mode, timely interception is achieved, alltampering operations can be avoided and monitored, and real-time performance, effectiveness and convenience of registry protection are achieved.

Description

technical field [0001] The invention relates to the technical field of registry security protection, in particular to a terminal registry security protection method and protection system based on windows drive technology. Background technique [0002] The registry is a core database in the windows operating system, which stores various parameters, directly controls the startup of windows, the loading of hardware drivers, and the operation of some windows applications, thus playing a central role in the entire system. [0003] Registry damage may lead to abnormal operation of application software, failure to load drivers, and more seriously, system failure to start, which may also lead to serious network security risks. Some Trojan horses and viruses achieve the purpose of hiding themselves or destroying behaviors by writing into the registry, effectively protecting the registry of the host computer for terminal applications, operating systems, network security, behavior dete...

AI Technical Summary

Problems solved by technology

[0004] There are many traditional methods of protecting the registry, such as the method of periodically detecting whether the registry changes, but this method cannot detect changes in the registry in time, resulting in untimely protection of illegal host behaviors

For example, by capturing the mouse and keyboard events that the user modifies the registry on the interface, but this method cannot restrict malicious programs from modifying the registry by calling the windows system API

Another example is the method of manually backing up the registry. This method cannot protect the registry, but is only a remedial measure after the registry is found to be damaged.

Images