基于客户端蜜罐的恶意网页检测系统的设计与实现  

Design and implementation of mal-webpage detection system based on honeyclient

作　　者：孙晓妍[1] 王洋[1] 祝跃飞[1] 武东英[1] 

机构地区：[1]信息工程大学信息工程学院,郑州450002

出　　处：《计算机应用》2007年第7期1613-1615,共3页journal of Computer Applications

摘　　要：分析基于网页的恶意行为特点,设计一个基于客户端蜜罐的恶意网页检测系统。该系统将蜜罐与爬虫相结合,通过设计一个网络爬虫来获取url数据源,利用蜜罐内的客户段引擎自动化启动Internet Explorer浏览网页,并监控通过浏览恶意网页下载的恶意软件。最后,分析恶意代码,将恶意网页加入黑名单。Now, Intemet Explorer is the most popular client software which malwares often use. In allusion to such threats to Intemet Explorer, the characters of Web attack were analyzed, and a mal-webpage detection system based on honeyclient was designed, in which spider was combined with honeypot. In the system, spider was used to collect source of urls, then clientengine automatically created Intemet Explorer processes, and device-driven detector was used to detect malwares coming through Internet Explorer. In the end, the malicious webpage＇s url was added to the black list and the malware database was enlarged.

关 键 词：恶意软件 客户端蜜罐 INTERNET EXPLORER 网络爬虫 

分 类 号：TP302.1[自动化与计算机技术—计算机系统结构]