Diagnostic Techniques, Based On A Credible Base Of Malicious Code

Statistics indicate that the malicious code have become one of the main threat for computer system. With the deep contact between network and society, the purpose of malicious code released turns from showing off to obtaining economic or political benefits. The aim of attack become more clearly, it brings more security-hidden trouble to the information system.Most of the present products of detecting malicious code based on signature matching technology, the validity of detected and killed relies on its virus database update speed. Furthermore, these products can't work well when dealing with unknown malicious code. With the prevalence of Internet and application of new technique, the update speed of malicious code becomes more faster, while the update speed of virus database can't catch up with this change.Aimed at the trend of malicious code and the shortage of present detect technology, the commonness of malicious code is summarized, and its mechanism is analyzed, and then a detect scheme of malicious code based on the Trusted Computed-Based (TCB) is proposed. The foundation of this detect scheme is that the integrality of operation system (OS) will be changed when it attacked by malicious code. The fiducial database called TCB for diagnosing is built, which include OS states and its configures that malicious code always changed. The feasibility of setting up the database-TCB at the OS unattacked by malicious code is demonstrated. In addition, the weight table of malicious for suspicious files from hidden process, communications and auto load is built, which work is based on the malicious code mechanism analyzed and experiment. Finally, the detect conclusion is educed by comparing the OS state of object computer with corresponding data in TCB database and consider the weight table of malicious.According to the aforementioned detecting means, we achieved an archetypal diagnose system based on TCB This archetypal system can detect the malicious code from the process, the modules of process loaded, the Service Descriptor Table(SDT) and the drive program of computer loaded. At last ,we make some simulative experiments to evaluate the system by using our approach, the related experimental data and results of analysis demonstrate it is an effective method to detect malicious code under Windows OS, especially in detecting unknown malicious code is much more effective than the current detection product based on signature matching. In a word, the work of this thesis analyzed malicious code mechanism and explored their commonness, also provides theoretical foundation to develop the method and technique for prevention against malicious code. It can be an effective work that we presented the new approach to detecting the malicious code based on TCB. Particularly, it much more effective in detecting the malicious code which has clearly attack object and doesn't spread large-scale. It would achieve high efficiency to detecting malicious code if we take good use of the approach and current virus detecting products.In addition, the idea of detecting malicious code based on TCB in this thesis can be applied to prevent malicious code, and make a system with both detection and prevention functions. Thus it can better protect the computer against being attacked by the malicious code.