一种改进的基于扩展攻击树模型的木马检测方法  

AN IMPROVED TROJANS DETECTION METHOD BASED ON EXTENDED ATTACK TREE MODEL

作　　者：陈燕红[1] 欧毓毅[1] 凌捷[1] Chen Yanhong;Ou Yuyi;Ling Jie(Faculty of Computer, Guangdong University of Technology, Guangzhou 510006,Guangdong, China)

机构地区：[1]广东工业大学计算机学院,广东广州510006

出　　处：《计算机应用与软件》2016年第8期308-311,333,共5页Computer Applications and Software

基　　金：广东省自然科学基金重点项目(S2012020011071);广东省高校科技创新项目(2013KJCX0064)

摘　　要：木马作为恶意程序的一种,经常被作为黑客入侵利用的手段,这对网络安全和信息安全将造成极大的危害。提出一种改进的基于扩展攻击树模型的木马检测方法。通过分析PE文件,采用静态分析和动态行为监控技术相结合的检测方法提取程序API调用序列;并用信息增益的方法筛选出木马关键API短序列集合,作为构建扩展攻击树模型的特征库;将待检测程序以API短序列为行为特征与模型节点进行匹配、分析,同时改进了匹配节点的权值和危险指数的算法。最后给出扩展攻击树模型调整与优化的方法。实验结果表明,改进后的方法不仅在木马检测效率、准确度方面有较好的表现,还能检测出经过升级变种的木马。T ro ja n s , as one k in d o f m alw ares, are often used as the ha ckin g m eans, and this w ill cause great harm to the secu rity ofnetw ork and info rm atio n. W e proposed an im proved T rojans detection m ethod w h ich is based on extended attack tree m odel. F irs t, byanalysing PE file s , the m ethod extracts the c a ll sequence o f p ro g ra m ,s A P I using the detection m ethod com b in in g the static analysis anddynam ic behaviour m o n ito rin g; T h en it sifts the key short c a ll sequence set o f A P I using the m ethod o f in fo rm a tio n as the feature lib ra ry fo rb u ild in g extended attack tree m o d e l; F u rthe rm o re, it takes the A P I short c a ll sequence as the behavioural feature o f the de tecting program tom atch the m odel nodes and then analysis th e m ,m eanw hile im proves the algorithm s o f m atching nodes ’ w eigh t and ris k in d e x as w e ll. F in a lly ,we introduce d the m ethod to adjust and optim ise the extended attack tree m odel. E xperim enta l results showed th a t the im proved m ethod hadbe tter perform ance in T rojans detection e fficie n cy and a ccu ra cy, and could detect the upgraded va ria n t o f the T rojan as w e ll.

关 键 词：木马检测 扩展攻击树 API调用 改进算法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]