关键词: 进程合法性验证, 进程创建过程, 内核态, 路径树

Abstract: In order to prevent malignant processes on Windows platform from destroying system resources, a validation technique via kernel mode driver was presented. This validation hooked the creation of processes and got their execution file paths, then checked whether the processes were legal. The validation procedure ran in Windows kernel mode and utilized a data structure named path-tree to speed up the validation. By this method, malignant processes can be terminated before their accomplishment of creation, so as to avoid causing damages to system resources.

Key words: process validation, process creation, kernel mode, path-tree