基于HoneyClient蜜罐的挂马检测  

Detection of Web-site with Trojan Based on HoneyClient

作　　者：陈凌[1] 王轶骏[1] 薛质[1] 

机构地区：[1]上海交通大学信息安全工程学院,上海200240

出　　处：《信息安全与通信保密》2010年第5期75-77,共3页Information Security and Communications Privacy

摘　　要：针对当前互联网客户端攻击频发的态势,首先阐述了基于本地程序漏洞的客户端攻击概念,着重讲解了网站挂马攻击的特征。其次阐明了客户端蜜罐系统的基本原理,并介绍了一种高效的客户端蜜罐系统HoneyClient。随后通过对网站挂马攻击的特征分析提出了使用HoneyClient对其进行有效检测的方案,并对该方案进行了事实验证。最后通过对实验结果的分析与总结,提出了对网页木马型客户端攻击进行检测的改进策略和展望。As client-side attacks occur frequently on the Internet,this article describes the concept of client-side attacks based on local-program vulnerabilities,and focuses on the characteristics of Web Trojan attacks. Then it,clarifi es the basic principles of the client-side honeypot system,and gives an effi cient client-side honeypot system HoneyClient. Then in the light of characteristic analysis on Web Trijan,it presents an effective Web Trojan detection scheme based on HoneyClient. The effi ciency of this scheme is tested and verifi ed. Finally,based on analysis of the results and summary,improvement strategies and development prospects for detection of client-side Web Trojan attacks are provided.

关 键 词：客户端攻击 客户端蜜罐 网站挂马 蜜罐 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]