USB可移动存储设备监控软件研究与实现-《计算机技术与发展》

文章信息/Info

Title:: Research and Implementation on USB Monitor Software for Removable Devices

Keywords:: USB removable storage device; filter driver of file system; file monitor

摘要:: 针对USB可移动存储设备日益成为越来越多的病毒、木马的主要攻击对象，尤其是窃密木马等会扫描接入系统的USB可移动存储设备并将机密文件秘密地复制并通过网络发送出去，造成严重的安全隐患的问题，文中在微软文件系统过滤驱动开发模型Sfilter的基础上，设计开发了一款USB可移动存储设备监控软件，通过截获对于USB可移动存储设备内文件操作的IRP( I/O Request Packet)，分析出相应的文件操作类型，对截获到的IRP进行不同的处理，实现了可控的安全进程规则与防拷贝功能，并结合相应的日志显示最终保证了USB可移动存储设备内文件的安全性。经过实验测试，软件系统运行正常，能够有效监控USB可移动存储设备内文件的访问和存取等操作

Abstract:: Aiming at the problem that the USB portable storage devices have been considered as one of the chief attacking targets by an increasing number of computer viruses and Trojans,some of which can even scan for the available USB device,sneakingly copying its se-cret documents and then spreading them with network,finally triggering serious security issues,based on Sfilter,the filtering driver proto-type of Microsoft file system,develop a USB monitor software whose functions by intercepting various IRP ( I/O Request Packet) of the USB device are to work out the corresponding file operation types and take relevant reactions. The system supports custom-made security process rules,achieves anti-copying and guarantees the security of the USB device by showing the logs. The experiment shows that the system works well and is able to effectively supervise the accessing to the files in USB device