摘要:网页木马是一种在网页中插入攻击脚本，利用浏览器及其插件中的漏洞，使受害者的系统静默地下载并安装恶意程序的攻击形式.结合动态程序分析和机器学习方法，提出了基于动态行为分析的网页木马检测方法.首先，针对网页木马攻击中的着陆页上的攻击脚本获取行为，监控动态执行函数执行，包括动态生成函数执行、脚本插入、页面插入和URL跳转，并根据一套规则提取这些行为，此外，提取与其相关的字符串操作记录作为特征；其次，针对利用堆恶意操作注入shellcode的行为，提出堆危险指标作为特征；最后，从Alexa和VirusShare收集了500个网页样本作为数据集，用机器学习方法训练分类模型.实验结果表明，与现有方法相比，该方法具有准确率高（96.94%）、可有效地对抗代码混淆的干扰（较低的误报率6.1%和漏报率1.3%）等优点.



Abstract:Web Trojan is a form of attack that inserts an attacking script into the Web page,and by exploiting the vulnerabilities of browsers and their plug-ins,it causes the victim's system silently download and install malicious programs.Based on dynamic program analysis and machine learning method,this paper proposes a method of detecting Trojans based on dynamic behavior analysis.Firstly,the behaviors of the attack scripts on the landing page,including the dynamic function execution,the dynamic generation function execution,the script insertion,the page insertion and the URL jump,are monitored.Then these behaviors are extracted according to a set of rules.The associated string operation records are also processed as features.Next,for the use of heap malicious operation (the shellcode behavior),a feature indicating the heap risk is proposed.Finally,500 web samples from Alexa and VirusShare are collected as data sets,and a classifier is trained by machine learning method.The experimental results show that compared with the existing methods,the presented method has high accuracy (96.94%) and can effectively prevent interference of code obfuscation (lower false positive rate of 6.1% and false negative rate of 1.3%).



PDF全文下载地址:

http://jos.org.cn/jos/article/pdf/5495