信息系统恶意代码检测关键技术研究

发布时间：2018-07-28 15:26

【摘要】：随着国家信息技术的快速发展和综合国力的提升,商业秘密信息和国家秘密信息成为了窃密者的重要攻击对象。由于信息系统外部软硬件国产化进程还无法适应当前的技术发展和需要,因而为窃密者提供了大量的可利用的系统漏洞和攻击途径,其中,以恶意代码为典型代表的攻击方式在信息系统内屡见不鲜,且攻击方式不断优化。对于这些恶意代码,一旦无法及时检测和清除,轻者破坏信息系统的部分功能和应用环境,重者则直接窃取敏感的涉密信息,给国家安全和经济建设造成严重的损失。为此,恶意代码检测技术已成为我国政府、军队和科研院所重点关注的研究问题。虽然人们对恶意代码特征以及信息系统安全防护等相关技术进行了长期研究,提出了各类有效技术及机制并试图解决信息系统内恶意代码检测与清除研究中所遇到的各类安全问题,但这些技术并没有很好地适应信息系统的综合环境和特性。本文以信息系统内恶意代码基本特征为研究对象,以信息系统安全为研究内容,从恶意代码检测的实用角度出发,深入研究了可适应信息系统环境,具有特殊攻击性、潜伏性等特点的恶意代码行为方式,并提出了综合性的恶意代码检测方法。首先,以信息系统为例,应用程序、进程和服务比较单一,特别是文件、网络、注册表等访问行为。为此,针对恶意代码善于伪装以及添加无序行为的方式来逃避检测的情况,提出了运用齐次隐马尔可夫模型提高判断恶意行为准确性的方法。该方法通过对于危险行为特征的概率计算,能够准确地识别恶意代码程序加壳以及无序干扰的伪装方式,提高信息系统环境恶意代码的检测率。其次,在信息系统中,为了混淆恶意特征以及行为,恶意代码往往会通过变种的方式,为此,提出了基于启发式的恶意代码检测方法,通过静态的行为特征,按照特征的判别熵进行特征精简,来比较所有与正常样本存在差异的样本。对于通过采用自修改代码技术隐藏自身逻辑的恶意代码,提出了使用虚拟机技术新生恶意代码位置的方法,并调用静态检测部分进行检测,达到检测自修改代码未知恶意代码的目的。最后,在信息系统中,恶意代码最显著的特征是自身隐蔽性,为了达到事前预防的最佳效果,提出了基于主机检测的恶意代码检测方法,获取常规情况下系统服务或应用程序对象对系统函数的调用层次树,将实时情况下检测得到的调用层次树与常规模式下的调用层次树进行相似度比较,当相似度超出阂值,则判定目前函数的调用行为是恶意的。特别对于利用一些常见应用程序漏洞,而植入恶意代码的可疑目标,能够实现主动发现,并主动诱使恶意代码进行攻击,进而实现检测。
[Abstract]:With the rapid development of national information technology and the promotion of comprehensive national strength, trade secret information and state secret information have become an important object of attack. Because the process of localization of external software and hardware of information system can not meet the current technological development and needs, it provides a large number of exploitable system vulnerabilities and attack channels for the burglars, among which, The attack mode represented by malicious code is common in the information system, and the attack mode is optimized constantly. For these malicious codes, once they can not be detected and cleared in time, the light ones destroy part of the functions and application environment of the information system, while the heavy ones directly steal sensitive confidential information, causing serious losses to national security and economic construction. Therefore, malicious code detection technology has become the focus of our government, military and research institutes. Although people have carried out long-term research on malicious code features and information system security protection and other related technologies, This paper puts forward various effective technologies and mechanisms and tries to solve all kinds of security problems encountered in the research of malicious code detection and clearance in information systems, but these technologies do not adapt well to the comprehensive environment and characteristics of information systems. This paper takes the basic characteristics of malicious code in information system as the research object, takes the security of information system as the research content, from the practical point of view of malicious code detection, deeply studies the adaptability to the information system environment, and has special aggression. This paper presents a comprehensive detection method of malicious code, which is characterized by latent behavior. First, take the information system as an example, the application, the process and the service are relatively single, especially the file, the network, the registry and so on access behavior. For this reason, aiming at the situation that malicious code is good at camouflage and adding disorder behavior to avoid detection, a method of improving the accuracy of malicious behavior by using homogeneous hidden Markov model is proposed. By calculating the probability of dangerous behavior characteristics, the method can accurately identify the malicious code program shell and disordered interference camouflage, and improve the detection rate of malicious code in information system environment. Secondly, in information systems, in order to confuse malicious features and behaviors, malicious code is often used in a variety of ways. Therefore, a heuristic based malicious code detection method is proposed, and static behavior features are used to detect malicious code. According to the discriminant entropy of the feature, the feature is reduced to compare all samples which are different from the normal samples. For malicious code which uses self-modifying code technology to hide its own logic, the method of using virtual machine technology to generate malicious code location is put forward, and the static detection part is called to detect the malicious code. To detect self-modified code unknown malicious code. Finally, in the information system, the most prominent feature of malicious code is its concealment. In order to achieve the best effect of prevention in advance, a method of malicious code detection based on host detection is proposed. The system service or application object's invoking hierarchical tree of system function is obtained in the general situation, and the similarity degree of the detected invocation hierarchy tree in real-time is compared with that of the calling hierarchy tree in the conventional mode. When the similarity exceeds the threshold value, the system service or application object invokes the hierarchical tree of the system function. It is determined that the calling behavior of the current function is malicious. Especially for embedding suspicious targets of malicious code by exploiting some common application vulnerabilities, we can realize active detection and actively induce malicious code to attack, and then realize detection.
【学位授予单位】：哈尔滨工程大学
【学位级别】：博士
【学位授予年份】：2016
【分类号】：TP309

【相似文献】