Terminal registry security protection method and system based on windows driving technology

Abstract

The invention discloses a terminal registry security protection method and a protection system based on windows driving technology, wherein the protection method comprises the following steps: capturing a registry request modification instruction sent by an operating system. Determine whether the registry requested to be changed is the registry in the registry protection policy to be protected. Intercept the change operation and control the agent component to send a prompt message to the user when the requested registry is the registry to be protected in the registry protection policy. The terminal registry security protection method based on the windows driving technology proposed by the invention adopts the windows operating system driving mode to protect the specified registry path and all subkeys from being tampered with and deleted. Real-time detection and timely interception can be achieved by means of windows operating system driving, and all tampering operations can be avoided and monitored, thereby realizing the real-time, effectiveness and convenience of registry protection.

Description

technical field [0001] The invention relates to the technical field of registry security protection, in particular to a terminal registry security protection method and protection system based on windows driving technology. Background technique [0002] The registry is a core database in the windows operating system, which stores various parameters, directly controls the startup of windows, the loading of hardware drivers, and the running of some windows applications, thus playing a central role in the entire system. [0003] Registry corruption may cause application software to run abnormally, driver loading failures, or, more seriously, cause the system to fail to boot, which may also lead to serious network security risks. Some Trojan horses and viruses achieve the purpose of hiding themselves or destroying their behavior by writing to the registry, effectively protecting the registry of the host for terminal applications, operating systems, network security, behavior det...

AI Technical Summary

Problems solved by technology

[0004] There are many traditional methods of protecting the registry, such as the method of periodically detecting whether the registry changes, but this method cannot detect changes in the registry in time, resulting in untimely protection of illegal host behaviors

For example, by capturing the mouse and keyboard events that the user modifies the registry on the interface, but this method cannot restrict malicious programs from modifying the registry by calling the windows system API

Another example is the method of manually backing up the registry. This method cannot protect the registry, but is only a remedial measure after the registry is found to be damaged.

Images