基于AST的网页木马解混淆技术  

Drive-by-Download Attack Deobfuscation based on AST

作　　者：项家齐 王轶骏[1] 薛质[1] 

机构地区：[1]上海交通大学信息安全工程学院,上海200240

出　　处：《信息安全与通信保密》2015年第4期88-92,共5页Information Security and Communications Privacy

基　　金：高级XXX技术研究(秘密级)(CNITSEC-KY-2013-009/2)

摘　　要：网页木马是最近几年非常流行的一种恶意代码分发的形式,其目标群体庞大,已经发展为传播最广泛,危害最严重的一种客户端攻击类型,而对网页木马的分析是网页木马研究的重要基础和前提。本文主要关注网页木马为了隐藏自身并提高攻击成功率而引入的混淆技术,首先讨论了各种当前的解混淆技术,然后引入了利用抽象语法树的解混淆技术,并实现了一套基于该技术的原型系统,最后使用多种类型的网页测试了原型系统,证明了该技术的有效性。Drive-by-download attack,as a popular way to distribute malicious code in recent years,has a huge amount of potential victims and now becomes the most widespread and the most detrimental client- side attack. The analysis of drive-by-download attack is the prerequisite and foundation for the research. This paper mainly focuses on the obfuscation techniques of drive-by-download attack's,which make it harder to detect the malicious codes. Firstly,the common deobfuscation techniques are discussed,then the deobfuscation techniques based on AST described,and based on this technology,a set of prototype system is implemented,and finally,the tests on the prototype system based on different types of web pages,indicate the effectiveness of this proposed technology.

关 键 词：抽象语法树 解混淆 网页木马 客户端蜜罐 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]