网页恶意代码检测技术研究与实现

发布时间：2018-08-19 21:24

【摘要】：随着Web2.0时代以及云端技术的发展,越来越多的应用倾向于以B/S架构向用户提供服务。但是,恶意代码也倾向于通过网页来传播,特别是网页恶意代码利用浏览器漏洞或者浏览器插件漏洞等获取用户敏感数据,甚至植入系统后门或勒索软件等。这种方式已经成为恶意代码传播的主要渠道,也是“地下经济”的重要环节。本文对网页恶意代码攻击方式与运作流程进行了深入研究,分析了现有网页恶意代码检测技术的主要方向和有效途径,提出了基于解析引擎的网页恶意代码动态检测方案,设计并实现了网页恶意代码检测系统。论文的主要工作及成果包括如下几个方面:(1)针对静态文本分析无法有效检出混淆之后的网页恶意代码的问题,基于解析引擎实现了对网页恶意代码特征的动态检测与提取;(2)在动态特征检测技术的基础上提出恶意特征提取模型,用于规范化特征提取流程和格式化特征向量;在机器学习理论与恶意特征提取模型的基础上提出了基于解析引擎的网页恶意代码分类模型,实现对网页恶意代码样本的训练和学习;(3)设计、实现了网页恶意代码检测系统,并对系统的各组成模块进行了详细设计;(4)搭建系统测试环境,对分类模型的性能以及网页恶意代码检测系统的功能进行了测试。测试结果表明,本系统较好的解决了静态文本分析对混淆网页恶意代码检出率低等问题。
[Abstract]:With the development of Web2.0 and cloud technology, more and more applications tend to provide services to users with B / S architecture. However, malicious code also tends to propagate through web pages, especially web pages that use browser vulnerabilities or browser plug-in vulnerabilities to obtain user sensitive data, or even implant system backdoor or extortion software. This way has become the main channel of malicious code dissemination, also is the important link of "underground economy". In this paper, the attack mode and operation flow of web page malicious code are deeply studied, and the main directions and effective ways of existing malicious code detection technology are analyzed, and the dynamic detection scheme of web malicious code based on parsing engine is put forward. A malicious code detection system for web pages is designed and implemented. The main work and achievements of this paper are as follows: (1) aiming at the problem that static text analysis can not effectively detect the malicious code after confusion, Based on the analysis engine, the dynamic detection and extraction of malicious code features are realized. (2) based on the dynamic feature detection technology, a malicious feature extraction model is proposed, which is used to standardize the feature extraction process and format feature vectors. On the basis of machine learning theory and malicious feature extraction model, a web malicious code classification model based on parsing engine is proposed to realize the training and learning of web malicious code samples. (3) A web malicious code detection system is designed and implemented. The components of the system are designed in detail. (4) the system testing environment is built and the performance of the classification model and the function of the web malicious code detection system are tested. The test results show that the system can solve the problem of low detection rate of malicious code in static text analysis.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【参考文献】