一种网页挂马攻击中的重定向混淆检测方法  

A Detection Method of Obfuscated Redirection in Drive-by Download Attack

作　　者：郭川[1] 李晓峰[2] 马多贺[1] 徐震[1] 

机构地区：[1]中国科学院信息工程研究所信息安全国家重点实验室,北京100093 [2]北京邮电大学计算机学院,北京100876

出　　处：《网络新媒体技术》2014年第3期21-27,共7页Network New Media Technology

基　　金：中国科学院先导专项课题(XDA06010701)

摘　　要：当前关于网页挂马攻击检测的研究集中于静态检测方法和动态检测方法,但随着Web应用中动态交互技术及代码混淆技术的大量应用,静态检测方法效果已不明显,同时动态检测方法往往耗时过多。本文在总结当前关于网页挂马攻击检测研究的基础上,提出网页挂马攻击中的JavaScript重定向混淆检测方法,并基于开源JavaScript脚本引擎SpiderMonkey进行设计与实现。此方法可有效解决网页挂马攻击中的JavaScript脚本重定向混淆问题,也可作为低交互客户端蜜罐与高交互客户端蜜罐结合使用提高检测效率。The current research in the detection method of Drive - by Download attack focus on static method and dynamic method. With the widely use of dynamic interactive technology and code obfuscation techniques in web applications, the static detection method has become useless. At the same time, the dynamic detection method is too much time - consuming. This paper summarizes researches on the detection of the drive - by download attack, proposed a detection method of obfuscated JavaScript redirection in Drive - by Download attack, designed and implemented the detection method on the base of the open source JavaScript engine--SpiderMonkey. This method can effectively detect the obfuscated JavaScript redirection in the Drive - by Download attack, and as a low - interactive client honeypot can be a fast complementary of the high - interactive client honeypot.

关 键 词：网页挂马攻击 JavaScript混淆 网页重定向 SpiderMonkey低交互客户端蜜罐 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]