基于搜索引擎的恶意对象发掘系统的设计与开发

发布时间：2018-06-26 02:24

本文选题：搜索引擎 + 恶意软件　；参考：《山东大学》2013年硕士论文

【摘要】：恶意对象发掘系统是卡巴斯基公司针对现有的样本收集和分析处理系统的一次研究性尝试,其方向符合未来杀毒行业发展的基本趋势。其中涉及到多个学科和业行的技术,是一个典型的利用多学科知识交叉实现的系统。如搜索引擎技术、分布式系统并行处理架构、机器学习和虚拟机系统等。系统摒弃传统杀毒行业一直沿用的被动收集和感染后查杀的模式,采用主动检索,在大数据和海量文件的基础上进行挖掘和抽取。这种积极发现恶意程序并在恶意程序感染和扩散之前更新病毒库的方式,在第一时间阻断了可能感染用户的信息渠道。本文采用统一建模的工程方法,以面向对象的思想对系统进行需求分析和设计。在系统需求分析章节我们对总体业务系统的流程进行了详细说明,分析了四大模块的功能,对模块与模块之间的协作关系进行描述,样本收集为例,着重研究了对原始网页的采集,分类及分析过程。从活动图设计、类结构设计、数据库设计等方面详细描述系统的设计,得到了系统中的设计类和数据库模型；重点分析了样本基础信息库和网址分类库的表设计。全文通过对借助搜索引擎进行恶意软件传播的传播方式及特点的分析,有针对性的设计出一套精准有效的监测和自动查杀系统。在整体上系统使用了典型的C/S架构。因为涉及到大量现有的功能平台,系统使用跨平台的软件技术以兼容和驱动繁杂的异构系统,所以我们选用各种平台无关的脚本语言开发主要业务逻辑,例如Perl,PHP等。在病毒样本收集阶段,基于虚拟机实现了一个分布式系统检测环境。创建并引入恶意对象流的概念,在此基础上设计了系统对潜在恶意对象的智能判断以及自动化处理流程。其中重点介绍了如何基于搜索引擎发现恶意对象和恶意对象的分类处理,基于恶意对象特征库,采用支持向量机设计出一个恶意程序检测算法,并用实验实证的方法进行数据比对,分析该算法的理论可行性和实用性。最后进行软件测试对各项功能进行评测。该系统目前在实验室内稳定运行,根据现有的统计数据看,系统基本达到预期。系统已经开始为公司业务系统贡献了很多有价值的恶意程序样本。
[Abstract]:The malicious object discovery system is a research attempt of Kaspersky Company aimed at the existing sample collection and analysis and processing system, and its direction accords with the basic trend of the future development of antivirus industry. The technology involves many disciplines and industries, and it is a typical system using multidisciplinary knowledge. Such as search engine technology, distributed system parallel processing architecture, machine learning and virtual machine systems. The system abandoned the traditional anti-virus industry has been used passive collection and post-infection kill mode, using active retrieval, on the basis of big data and massive files for mining and extraction. This way of actively detecting malicious programs and updating the virus library before the malicious program infects and spreads blocks the information channel of the possible infected users at the first time. In this paper, the unified modeling engineering method is used to analyze and design the requirements of the system with the idea of object-oriented. In the chapter of system requirement analysis, we explain the flow of the whole business system in detail, analyze the functions of the four modules, describe the cooperative relationship between the modules and the modules, and collect samples as an example. The process of collecting, classifying and analyzing the original web pages is studied emphatically. The design of the system is described in detail from the aspects of activity diagram design, class structure design, database design and so on. The design class and database model of the system are obtained, and the table design of the sample base information base and the URL classification database is analyzed. Based on the analysis of the transmission mode and characteristics of malware spread by search engine, a set of accurate and effective monitoring and automatic killing system is designed in this paper. On the whole, the system uses a typical C / S architecture. Because it involves a large number of existing functional platforms, the system uses cross-platform software technology to compatible and drive complex heterogeneous systems, so we choose various platform-independent scripting languages to develop the main business logic, such as Perl PHP and so on. In the phase of virus sample collection, a distributed system detection environment based on virtual machine is implemented. The concept of malicious object flow is created and introduced. Based on this, the intelligent judgment and automatic processing flow of potentially malicious objects are designed. It focuses on how to classify and process malicious objects and malicious objects based on search engine. Based on the signature library of malicious objects, a malicious program detection algorithm is designed by using support vector machine (SVM). The theoretical feasibility and practicability of the algorithm are analyzed. Finally, software tests are carried out to evaluate the functions. The system is running stably in the laboratory at present. According to the existing statistics, the system basically meets the expectation. The system has begun to contribute a number of valuable samples of malicious programs to the company's business systems.
【学位授予单位】：山东大学
【学位级别】：硕士
【学位授予年份】：2013
【分类号】：TP311.52;TP391.3

【相似文献】