Design and Implementation of A process-protecting system In Windows NT

摘要

One of the pressing problems facing security software today is that the defense strength for its process is not high, which makes the selfprotection of software so inadequate that malicious application can terminate it by some ways. After analyzed the current status of the technology of process protection, a process-protecting project which is proposed in this paper, utilizes SSDT hook, inline hook and technique of two processes and three threads to construct a process-protecting system of high strength and multi-layered. This system contains three prevention mechanisms-monitor, guard, restore, can remedy the deficiency in a lot of security software that strength of software self-defense is not high, and enhance the ability of self-protection about software. Finally, experimental testing validate that the system has a strong ability to protect the process and terminate the malicious program to eliminate its threat in Windows. Therefore, it is effective for this system to further safeguard the safe operation of security software.