关键词: Rootkit, 异构BIOS环境, 协同隐藏, 形式化模型, 可信计算, 检测

Abstract: Based on the traditional Trojan horse model framework, this paper analyzes and improves the Rootkit’s formal model about cooperative concealment, and implements a formal detection model of Rootkit for heterogeneous BIOS environment. The model divides the entire inspection process into three modules based on the ideas of cooperative concealment. The Rootkit samples under heterogeneous BIOS environment are studied, and combined with the idea of trusted computing, a detection method based on trusted computing is proposed. This method is combined with the formal detection model of Rootkit. It establishes three trusted chains according to the results of Rootkit sample analysis of multiple heterogeneous BIOS environments. and proposes different detection ideas for different modules, such as integrity detection method based on trusted computing and detection of entry addresses of interrupt vector tables. Experimental results show that the detection method can effectively detect Rootkit in different system environments under heterogeneous BIOS environment.

Key words: Rootkit, heterogeneous BIOS environment, cooperative concealment, formal model, trusted computing, detection