基于网页动态视图的网页木马检测方法  

Detection of drive-by downloads based on dynamic page views

作　　者：张慧琳[1,2] 诸葛建伟[1,2] 宋程昱[1,2] 韩心慧[1,2] 邹维[1,2] 

机构地区：[1]北京大学计算机科学技术研究所,北京100871 [2]教育部网络与软件安全保障重点实验室(北京大学),北京100871

出　　处：《清华大学学报（自然科学版）》2009年第S2期2126-2132,共7页Journal of Tsinghua University(Science and Technology)

基　　金：国家发展改革委员会信息安全专项(高技[2007]2035号);高等学校博士学科点专项科研基金(200800011019);国家"八六三"高技术项目(2006AA01Z410)

摘　　要：为了应对网页木马中利用内嵌链接动态生成和代码混淆技术实现的隐藏机制,建立了一种全面基于网页动态视图的网页木马检测方法。该方法以脚本执行引擎为核心,加入特定的混淆对抗和内嵌链接识别机制,基于一定的文档对象模型模拟来动态执行页面中的脚本,结合内嵌页面递归分析重构出网页动态视图,并基于重构出的网页动态视图进行网页木马检测。在开源工具PHoneyC的框架基础上实现了原型系统,对89个网页木马样本进行了网页木马检测。结果表明:本检测方法检测率为70.8%,高于基于单页面方法的29.2%和基于页面静态视图方法的43.8%。A dynamic page view based drive-by download detection method was developed to address the challenge hidden drive-by downloads which abuse inline linking dynamics creation and obfuscation.The method uses a script engine to execute page scripts with tools to reveal the script's actions and inline linking identification mechanisms and rebuilds the dynamic page view of the visited page by recursively analyzing the inline pages.The system then detects drive-by downloads based on the rebuilt dynamic page view.Tests on a prototype based on the open-sourced PHoneyC framework to detect 89 drive-by download samples showed that single page views in this paper had a detection rate of 29.2%,static page views had a detection rate of 43.8%,and the dynamic page views had a detection rate of 70.8%.Thus,the dynamic detection method has a much higher detection rate.

关 键 词：计算机网络安全 网页木马 内嵌链接 网页动态视图 文档对象模型(DOM) 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]