鉴定木马程序来源的两种方法  

Two Methods for Identifying the Origin of Trojan Code

作　　者：黄步根[1] 黄政[2] 赵兵[2] 

机构地区：[1]江苏警官学院公安科技系,南京210012 [2]南京市公安局网警支队,南京210005

出　　处：《中国司法鉴定》2009年第3期79-82,共4页Chinese Journal of Forensic Sciences

摘　　要：分析木马源程序自身的特征,提出两种鉴别目标代码宿源的方法:根据其机器码和注册码的计算方式或者根据收信地址的保存方式和加密计算方式和参数进行鉴别。上述方法客观而高效。After analyzing the characteristics of Trojan source code, two methods for identifying the Trojan objective code are proposed. One is based on the algorithm for calculating the machine code and the register code, and the other is based on the storing method of the receiver address and the encryption algorithm and parameters. The two methods are objective and efficient.

关 键 词：木马 目标程序 电子证据鉴定 

分 类 号：TP311.56[自动化与计算机技术—计算机软件与理论] F812.42[自动化与计算机技术—计算机科学与技术]