A Hidden Process Detection Model Based on System Management Mode

ZHAO Xiao-can; REN Ju; XU Yang; WANG Guo-jun

Chinese

您当前的位置：

首页 >

文章列表页 >

A Hidden Process Detection Model Based on System Management Mode

更新时间：2026-09-04

- A Hidden Process Detection Model Based on System Management Mode
- Vol. 34, Issue 12, Pages: 111-115(2017)
- 作者机构：
  
  1. 中南大学信息科学与工程学院,湖南,长沙,410083
  2. 广州大学计算机科学与教育软件学院,广东,广州,510006
- 作者简介：
- 基金信息：
- DOI：
  CLC：
- Published：2017
- 稿件说明：
移动端阅览
赵晓参, 任炬, 徐旸, 王国军. 一种基于系统管理模式的隐藏进程检测模型[J]. 微电子学与计算机, 2017, 34(12): 111-115.

ZHAO Xiao-can, REN Ju, XU Yang, et al. A Hidden Process Detection Model Based on System Management Mode[J]. 2017, 34(12): 111-115.
赵晓参, 任炬, 徐旸, 王国军. 一种基于系统管理模式的隐藏进程检测模型[J]. 微电子学与计算机, 2017, 34(12): 111-115. DOI：

ZHAO Xiao-can, REN Ju, XU Yang, et al. A Hidden Process Detection Model Based on System Management Mode[J]. 2017, 34(12): 111-115. DOI：

摘要

近年来

恶意程序的隐身性越来越强.针对这个问题

提出了一种基于系统管理模式(System Management Mode

SMM)的隐藏进程检测模型(SMM-based Hidden process Detection model

SHPD).该模型能够有效地检测系统中的隐藏恶意进程

同时保证自身的透明性.模型包括客户端和监控端两部分.客户端运行在BIOS中

利用内外语义信息建立操作系统进程的多个视图

将建立的视图发送到监控端.监控端通过对比视图间的差异

识别出隐藏的恶意进程.在提出的SHPD模型理论支持下

搭建了实验原型系统

并进行了功能测试和分析

实验结果证明了该模型的有效性.

Abstract

In recent years

the stealth of malware is getting stronger and stronger. In this paper

a SMM-based Hidden process Detection model (SHPD) is proposed. SHPD can effectively detect the stealthy process in system while ensuring its own transparency. SHPD consists of two parts: the client and the monitor. The client

which implemented in BIOS

uses both internal and external semantic information to establish multiple views of processes in OS and sends those process views to the monitor. The monitor identifies the stealthy process by comparing the differences between the views. In the paper

we build a prototype system under the support of the SHPD theory

and conduct functional testing and analysis. The experimental results verify the feasibility of SHPD.

关键词

Keywords

references

Branco R R, Barbosa G N, Neto P D. Scientific but not academical overview of malware anti-debugging, anti-disassembly and anti-VM technologies[C]// Black Hat. USA, 2012.

Intel Corporation. Intel 82801DB I/O Controller Hub 4(ICH4)[Z]. Intel Corporation, 2002.

Zhang Fengwei, Kevin Leach, Kun Sun, et al. SPECTRE: A dependable introspection framework via system management mode[C]// Dependable Systems and Networks (DSN), 2013 43rd Annual IEEE/IFIP International Conference on. IEEE, 2013: 1-12.

William A. R, Allan Tomlinson. SMM-based hypervisor integrity measurement[C]// Cyber Security and Cloud Computing (CSCloud), 2015 IEEE 2nd International Conference on. IEEE, 2015: 362-367.

Zhang Fengwei, Kevin Leach, Angelos Stavrou, et al. Using hardware features for increased debugging transparency[C]// Security and Privacy (SP), 2015 IEEE Symposium on. IEEE, 2015: 55-69.

Zhang Fengwei, Zhang Hongwei. SoK: A study of using hardware-assisted isolated execution environments for security[C]// Proceedings of the Hardware and Architectural Support for Security and Privacy 2016. ACM, 2016: 3.

Kortchinsky K. CLOUDBURST: A VMware guest to host escape story[C]//Black Hat. USA, 2009.

李博, 沃天宇, 胡春明, 等. 基于VMM的操作系统隐藏对象关联检测技术[J]. 软件学报, 2013, 24(2): 405-420. DOI: 405

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

A review of large model development: technological evolution from BERT to Deepseek

Aerial vehicle detection algorithm based on multi-scale fusion and small-object enhancement

Microservices anomaly detection based on the correlation of monitoring metrics

Aerial small object detection algorithm based on improved RT-DETR

A high-efficiency charge pump for ultra-low voltage boost systems

Related Author

No data

Related Institution

No data

AI问答

Postal code：100079
Tel：（010）53879206 Email：tmw@bjxintong.com.cn
Technical support is provided by Beijing Founder electronics co., LTD 京ICP备09082226号-64 京公网安备11010602201714号
It is recommended to read the content of this site in Chrome&IE9+. Please switch to extreme mode in browser 360.
Cookies We use cookies to help provide and enhance our service and tailor content. By continuing, you agree to the use of cookies.

⁰