Decoy:基于主动技术的恶意代码捕获系统  

Decoy: A Malware Collection System Based On Active Technology

作　　者：刘浩[1] 孙春奇[1] 李斌[1] 姜伟[1] 

机构地区：[1]哈尔滨工业大学国家计算机信息内容安全重点实验室,150001

出　　处：《微计算机信息》2009年第6期67-69,共3页Control & Automation

摘　　要：由于现有的被动捕获技术逐渐无法适应网络安全需要,本文提出一种基于主动技术的恶意代码捕获方法,结合主动技术和高交互式蜜罐构建了恶意代码自动捕获系统Decoy。Decoy主动寻找夹带恶意代码的可疑目标,启动客户端浏览器主动访问,诱导恶意代码实施攻击,进行实时监控并加以捕获。实验证明,采用主动技术的捕获器,主动性强,捕获效率高。Current malware passive-collecting methods can＇t fulfill the network security＇s need. A malware collection method based on active technology is proposed; a malware auto-collection system using active principle and high-interaction honeypot is implemented called Decoy. In order to lure malware, Decoy actively finds and visits doubtful aims, using browser as client software and using real-time inspecting method to collect malware. Decoy has a higher collection efficiency, which validated by experiment.

关 键 词：主动技术 蜜罐 恶意代码捕获 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]