Data Identify in Programs of Windows by Hooking

• 1、BeiJing University of Post and Teconology, Beijing 100876
• 2、Research Center of Information Security，Institute of Computing Technology,Chinese Academy of Sciences,Beijing,P.R.China

Abstract：In this paper a method which used to match network data to the right application process was proposed.There were two main ways to biuld reference data.Firstly, reference data can be achieved by simulation. All the data which were produced by the specified process running at a fixed time peroid and fixed computers were assigned to this specified peocess. Simulation can lead to data useless because it brought about people's influences. Secondly, DPI can analyze network data and attatch them with the application name label which were keeped in signature database. However, DPI doesnot work when it is unware of signatures of new applicaations or the network data which had been encrypted. In this paper, we find it is available to identify network data by hooking and controling some system functions. API Hook system was composed of Hook Server and Hook Driver. Hook Server copied Hook Driver into address space of the process. Hook driver hooked and controled the system functions.The reserch shows that this method can identy the network data completely and exactly.

Keywords： Windows API DPI process data identify Hook Server Hook Driver