数据挖掘在恶意网页动态检测中的应用研究

发布时间：2018-02-24 17:08

本文关键词： 恶意网页检测蜜罐技术 Capture-HPC 数据挖掘　出处：《上海交通大学》2012年硕士论文　论文类型：学位论文

【摘要】：随着计算机互联网的发展，人们通过网络进行着娱乐、购物、工作、电子商务等一系列的活动。其中，网页浏览在这些活动当中占据着非常多的一部分比重，正因为如此，许多不法分子和黑客瞄准了人们对于网络安全意识薄弱的漏洞，肆意地进行恶意攻击、侵入用户的系统，其中恶意网页是最为严重的一个网络安全问题，极大地危害了用户使用互联网的数据安全，甚至造成严重的经济损失。恶意网页检测技术也随着网络安全问题不断扩大而深入，静态网页检测分析和客户端蜜罐技术成为了恶意网页检测研究的重要领域。蜜罐是一种欺骗入侵者以达到采集黑客攻击方法和保护真实主机目标的诱骗技术。本文所使用的Capture-HPC是一种高交互度客户端蜜罐，它建立了一个虚拟的环境，模拟真实的操作系统和应用系统，故意暴露出各种弱点或漏洞，，引诱入侵者来攻击，攻击者对虚拟系统所做的任何改变和行为都会被记录在蜜罐日志中。本文设计并实现了一种恶意网页动态检测模型，模型通过对Capture-HPC蜜罐日志进行数据挖掘的方法，解决了Capture-HPC检测效率低，以及在实际应用过程中误警率过高的问题。该检测模型通过将蜜罐日志转换成操作序列和挖掘序列，可以有效地运用数据挖掘算法对海量日志文件进行挖掘与分析，从而优化本文的恶意网页检测系统，以寻找出攻击者的攻击方式和行为特征。本文主要阐述了三种常见的数据挖掘技术：聚类分析、关联规则挖掘、决策树分类，如何有效而合理地应用在本文的恶意网页动态检测模型当中。本文对于检测模型的模块构成和具体设计和实现的方法给予了详细地介绍，并通过真实地具体实验进一步验证了本文提出的恶意网页动态检测模型设计是合理的，数据挖掘的算法选取是正确的，挖掘技术应用在恶意网页检测中有效的，以及随之对于优化检测模型的效果是明显的。在实际的应用过程中，本文所提出的模型有着非常稳定和良好的恶意网页检测效果。
[Abstract]:With the development of the computer Internet, people are engaged in a series of activities such as entertainment, shopping, work, electronic commerce and so on through the network. Many lawless elements and hackers have aimed at the vulnerability of people's weak awareness of network security, carried out wanton malicious attacks and intruded into users' systems. Among them, malicious web pages are the most serious network security problems. It greatly endangers the data security of users using the Internet, and even causes serious economic losses. Malicious web page detection technology has also deepened with the expansion of network security issues. Static web page detection and analysis and client honeypot technology have become an important area of malicious web page detection. Honeypot is a deceptive technology to deceive intruders to collect hacker attack methods and protect real host target. The Capture-HPC used in this paper is a high degree of interaction client honeypot, It creates a virtual environment, simulates real operating systems and applications, deliberately exposes vulnerabilities or vulnerabilities, seduces intruders to attack, Any changes and behaviors made by an attacker to the virtual system are recorded in the honeypot log. This paper designs and implements a dynamic detection model for malicious web pages. The model solves the low efficiency of Capture-HPC detection by mining the honeypot log data. By converting honeypot log into operation sequence and mining sequence, the model can effectively use data mining algorithm to mine and analyze massive log files. In order to find out the attack mode and behavior characteristics of the attacker, the malicious web page detection system is optimized in this paper. This paper mainly describes three common data mining techniques: cluster analysis, association rule mining, decision tree classification, How to effectively and reasonably apply to the dynamic detection model of malicious web pages in this paper. This paper gives a detailed introduction to the module structure and the specific design and implementation of the detection model. Furthermore, the design of the dynamic detection model of malicious web pages proposed in this paper is proved to be reasonable, the algorithm selection of data mining is correct, and the application of mining technology is effective in the detection of malicious web pages. In the practical application process, the model presented in this paper has a very stable and good malicious web page detection effect.
【学位授予单位】：上海交通大学
【学位级别】：硕士
【学位授予年份】：2012
【分类号】：TP311.13

【参考文献】