Portal de Periódicos da CAPES

A generic anti-spyware solution by access control list at kernel level

2004; Elsevier BV; Volume: 75; Issue: 1-2 Linguagem: Inglês

10.1016/j.jss.2004.05.027

1873-1228

Sherman S. M. Chow, Lucas C. K. Hui, Siu Ming Yiu, K. P. Chow, Richard Wing Cheung Lui,

Advanced Malware Detection Techniques

Spyware refers to programs that steal the user information stored in the user’s computer and transmit this information via the Internet to a designated home server without the user being aware of this transmission. Existing anti-spyware solutions are not generic and flexible. These solutions either check for the existence of known spyware or try to block the transmission of the private information at the packet level. In this paper, we propose a more generic and flexible anti-spyware solution by utilizing an access control list in kernel mode of the operating system. The major difference between our approach and the existing approaches is that instead of asking a guard to look for the theft (spyware) or control the exit of the computer (and hence giving the spyware enough time to hide the information to be transmitted), we put a guard besides the treasure (the private information) and carefully control the access to it in the kernel mode. We also show the details of an implementation that realizes our proposed solution.