Abstract:With the growing number of domestic and international computer crime, remote monitoring for suspicious computers is becoming an important means to prevent computer crime and computer forensics. At the same time, remote monitoring technology plays an important role in information confrontation and cyber warfare of military. Such remote monitoring program must not be found by security defense or network monitoring software run on monitored computer, and then hide operation and communication. Hiding technology for remote monitoring is discussed in depth and implemented in this paper. The security defense soft- ware run on monitored computer captures the user access to sensitive information by intercepting system calls. In windows operating system, the interception is achieved by replacing system function entry addresses in SSDT (system service dispatch table) with own function addresses. In order not to be found by security defense program, remote monitoring must first recover function entry addresses in SSDT before it accesses to sensitive resources. This paper provides the method of SSDT recovering which recalculates and recovers the original addresses in function entry address table. The security defense software can capture network packets on the TDI(Transport Driver Interface) layer and NDIS(Network Driver Interface Specification) layer so as to monitor communication. To enable the communication between the monitored computer and the monitoring computer not to be found, it is necessary to penetrate through monitoring on TDI layer and the NDIS layer. This paper describes windows network architecture and network packet disposal process on NDIS and TDI layer, analyses the theory of security defense software capturing network communication, and puts forward the method for penetrating through the network monitoring on NDIS layer and TDI layer.

Technique of Network Topology and OS Camouflage

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

Port Scanning Techniques and Analysis of Attack and Defense

ALGORITHM AND REALIZATION OF NETWORK TOPOLOGY DISCOVERY

Multi-variant Network Address Hopping to Defend Stealthy Crossfire Attack

Research and Implement of Network Deception System Based on Network/host Copy

IP Spoofing Attack: Principles, Methods,Tools and Countermeasures

Improved Algorithm of Physical Topology Discovery in Heterogeneous IP Networks

New Backdoor Communication Way Based on Fake DNS and Sniffer

Design and realization of IP address takeover of high available system based on Linux

Remote OS Detection Based on TCP/IP Stack Fingerprinting

New Method to Avoid IP Address Embezzlement

Network Topology Discovery Based on Ip Address Inferring

Study on IP Hijack

Implementation of the TCP Packets in OS Detection Systems

Design and Implementation of Network Topology Discovering System

Research on Monitoring Hiding Technology in Protection System

Concealed in the Internet: A Novel Covert Channel with Normal Traffic Imitating

A Method of IP Network Topology Discovery

Research and Practice on Concealing Technology of Windows' Rootkit

Campus Network Security Alarm System Based on TCP Session Hijack