一种基于混淆机制的网页木马检测模型的研究与实现  

Research and Implementation of Webpage Trojan Detection Model Based on Obfuscation Mechanisms

作　　者：杜春来[1] 孙汇中 王景中[1] 王宝成[1] 

机构地区：[1]北方工业大学信息安全实验室,北京100144

出　　处：《信息网络安全》2015年第10期1-7,共7页Netinfo Security

基　　金：北京市自然科学基金[KZ2010009008];北京市高等学校人才强教计划资助项目[PHR2012];北京市创新团队计划项目[HT20130502]

摘　　要：网页木马是利用网页来进行破坏的恶意程序。当用户访问某些含有网页木马的网站时,木马程序就会通过网页中的内嵌链接被悄无声息地下载。这些木马程序一旦被下载、激活,就会利用系统中的某些资源进行破坏。目前针对网页木马的检测有基于特征码的静态检测方案和基于蜜罐客户端的动态检测方案,但这两种检测方案都无法很好地解决网页木马日益增多、混淆和躲避检测手段的问题。文章结合这两种网页木马检测方案的优点,提出一种基于网页内容分析和Shellcode定位识别的反混淆技术,该技术能够解决内嵌链接在动态验证时由于交互条件不存在而造成的漏报。在此基础上,加入动态和静态检测机制,建立了一种网页木马检测模型。实验数据表明,该模型能够准确地检测各种加壳、加密、变形等网页木马,提高了木马检测效率。Webpage trojan is a malicious program that uses the Webpage to carry out the destruction. When the user visits the Website that contains some Webpage trojans, the trojan program will be silently downloaded through the link embedded in the Webpage. Once the trojans are downloaded and activated, they will use resources in the system to destroy the computer system. Currently, Webpage trojan detection includes static detection based on feature codes and dynamic detection based on honeypot client, but the two detection schemes can＇t well solved the problems of growing number of Webpage trojans, confusion and avoiding detection means. This paper combines the advantages of the two detection schemes, putting forward an anti-obfuscation technology based on Webpage content analysis and shellcode location and recognition, which can solve the omission problem caused by interaction conditions not existing while verifying dynamically embedded links. On this basis, combined with the static and dynamic detection mechanisms, the paper establishes a Webpage trojan detection model. The experimental results show that the model can accurately detect various types of shell, encryption, deformation Webpage trojans, improving the detection eff iciency of trojans.

关 键 词：网页木马 内容分析 Shellcode定位 反混淆 加密 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP393.092[自动化与计算机技术—计算机科学与技术]