摘要
主机入侵防御是基于操作系统API监控的一种主动性安全防御技术,是面向客户端的安全解决方案。简要介绍该课题相关的技术背景和研究目标;系统论述主机入侵防御系统的防御思想、技术框架和基本特征;重点探讨Windows系统的API HOOK技术、基于API的行为监控和几种典型的异常行为分析技术,讨论各种行为分析技术的特点及其应用;最后指出该课题当前研究的技术瓶颈,并提出下一步研究的思路和方向。
Host-based intrusion prevention is an active security defense technology based on the operating system API monitoring, which is a security solution for the client-end. It briefly introduces the technical background and research objectives of the related topics. The prevention thought, framework and basic characteristics of host intrusion prevention system are presented and focused on the key technology of Windows API HOOK, behavior monitoring based on API and some of typical abnormal behavior analysis. And all the technology performance and aplication are provide. Finally the technical bottleneck of the current study is revealed and the countermeasures are given.
出处
《黑龙江工程学院学报》
CAS
2013年第3期63-66,共4页
Journal of Heilongjiang Institute of Technology
基金
黑龙江省教育厅资助项目(12531536)
