Hidden process detection method based on intercepting the entry of system kernel

At present, hidden process detection methods are avoidable, poor compatibility or high wastage. A method based on intercepting the entry of system kernel was proposed to solve these problems. The method applies the process behavior of communicating with system kernel to intercept the three channels: KiFastCallEntry, IDT and GDT, which were from user layer to kernel layer. Furthermore, the method applied the semantic reconstruction to establish the process list of kernel layer, and then combined with cross-view to detect hidden processes. The experiments show that the method proposed in this paper can detect all kinds of hidden processes at present. The method can be used in the majority of Windows operating system and it has higher detection accuracy, better compatibility, lower wastage and stronger pragmatic value.