Antivirus Software Shield Against Antivirus Terminators
Antivirus Software Shield Against Antivirus Terminators
复制标题
防病毒软件抵御防病毒终结者
DOI：
10.1109/tifs.2012.2206028
复制
发表时间：
2012
影响因子：
6.8
通讯作者：
Chieh
中科院分区：
文献类型：
--
作者：
Fu;Min;Chang;Chi;Chieh
在过去的几十年中，恶意软件作家和防病毒程序员之间的武器竞赛变得越来越严重。计算机用户确保计算机的最简单方法是在其计算机上安装防病毒软件。随着防病毒软件变得越来越复杂和强大，避开防病毒软件的检测成为恶意软件的重要组成部分。结果，恶意软件作者开发了各种方法来提高其恶意软件的生存能力和隐藏。这些技术之一是在执行恶意软件后立即终止防病毒软件。在本文中，我们提出了一种称为Antivirus Software Shield（ANSS）的机制，以防止在没有防病毒软件用户意识的情况下终止防病毒软件。 ANSS使用系统服务描述符表（SSDT）挂钩来拦截特定的Windows API，并分析它们以滤除将终止防病毒软件的危险API调用。当使用几块恶意软件可以终止各种品牌的防病毒应用程序来制定我们的实验时，结果表明，ANSS可以保护防病毒软件免于被它们终止，最多最多为0.42％的CPU性能开销和1.77％的记忆写入性能。
In the last several decades, the arms race between malware writers and antivirus programmers has become more and more severe. The simplest way for a computer user to secure his computer is to install antivirus software on his computer. As antivirus software becomes more sophisticated and powerful, evading the detection of antivirus software becomes an important part of malware. As a result, malware writers have developed various approaches to increase the survivability and concealment of their malware. One of these technologies is to terminate antivirus software right after the execution of the malware. In this paper, we propose a mechanism, called ANtivirus Software Shield (ANSS), to prevent antivirus software from being terminated without the consciousness of the antivirus software users. ANSS uses System Service Descriptor Table (SSDT) hooking to intercept specific Windows APIs and analyzes them to filter out hazardous API calls that will terminate antivirus software. When using several pieces of malware that can terminate various brands of antivirus applications to make our experiments, the results show that ANSS can protect antivirus software from being terminated by them with at most 0.42% CPU performance overhead and 1.77% memory write performance overhead.
影响因子：
2
作者：
Sylvain Firer-Blaess;C. Fuchs
通讯作者：
Sylvain Firer-Blaess;C. Fuchs