Research And Application Of Protection Of Program Files

Among various computer security events, virus, worm and trojian horse's infection take great proportion, their main infect target are applications. Once be infected, applications would bahavior abnormally or even couldn't execute. So it has both theoretic and practical values to study on application protection.Presently, a greate deal of work goes into the defense of virus, worm and trojian horse, brought forward many thechnologies which based on hardware, operating system and application software. Technologies based on hardware includes self-stored security device and security chip. Technology based on operating system includes security operating system and traditional access control policy. Technologies based on application consistes of virus-prevented software and sandbox. Howere, because of their limitaions, these technoligies couldn't resolve problemes of appliction protection entirely.Firstly, this dissertation analyses various system security drawbacks which could fall into three fields: Operating System, Windows management Mechanism of Registry and Application. Operating system have many security problems, such as administrator have super power,operating system needs repair and upgrade itself.The Windows management mechanism of registry have problems too, such as application's modifing to it, both the operating system and application's depending on it.Application's problems including: application files are stored in a mess, application file can't be deleted completely when the application is uninstalled, the existence of the temporary files can leak user's privacy etc. Based on these, this dissertation builds an application protection model, which named APM.Secondly,this dissertation gives a formal definition and introduces security properties of APM. APM's important security properties include: APM makes the application have least access right,APM is immune to malwares which have file-attacking actions,APM has ability to stop spread of the malwares and has real-time feedback when it detectes an attack.Finally, the APM is implemented in Windows XP. Some tests are completed and the result indicates APM can prevent malicious software's attack and stop its spread with little performance cost.