Technique Research of Trojan Horse Based on Escaping Behavioral Detection
Shufen Liu · Journal of Jilin University · 2007
In order to avoid the new generation trojan horse attack,the technique research of escaping behavioral detection is made.The methods of SDT(Service Descriptor Table) restoring and TDI(Transfer Driver Interface) NDIS(Network Driver Interface Specification) restoring are employed.The method of SDT restoring reads SDT from the kernel file ntoskrnl.exe according to the code characteristics of initializing SDT and utilizes the technique of reading kernel space in user mode to restore SDT so that trojan horse can escape behavioral detection during implanting and running.According to the theory of behavioral detection capturing communication,the method of TDI NDIS restoring adopts the technique of pre-deposit communication entry to escape communication behavioral detection.The experimentation shows that methods of SDT restoring and TDI NDIS restoring can escape behavioral detection of the famous antivirus softwares.