网页木马是利用网页来进行破坏的恶意程序。当用户访问某些含有网页木马的网站时，木马程序就会通过网页中的内嵌链接被悄无声息地下载。这些木马程序一旦被下载、激活，就会利用系统中的某些资源进行破坏。目前针对网页木马的检测有基于特征码的静态检测方案和基于蜜罐客户端的动态检测方案，但这两种检测方案都无法很好地解决网页木马日益增多、混淆和躲避检测手段的问题。文章结合这两种网页木马检测方案的优点，提出一种基于网页内容分析和Shel code定位识别的反混淆技术，该技术能够解决内嵌链接在动态验证时由于交互条件不存在而造成的漏报。在此基础上，加入动态和静态检测机制，建立了一种网页木马检测模型。实验数据表明，该模型能够准确地检测各种加壳、加密、变形等网页木马，提高了木马检测效率。%Webpage trojan is a malicious program that uses the Webpage to carry out the destruction. When the user visits the Website that contains some Webpage trojans, the trojan program will be silently downloaded through the link embedded in the Webpage. Once the trojans are downloaded and activated, they will use resources in the system to destroy the computer system. Currently, Webpage trojan detection includes static detection based on feature codes and dynamic detection based on honeypot client, but the two detection schemes can’t well solved the problems of growing number of Webpage trojans, confusion and avoiding detection means. This paper combines the advantages of the two detection schemes, putting forward an anti-obfuscation technology based on Webpage content analysis and shellcode location and recognition, which can solve the omission problem caused by interaction conditions not existing while verifying dynamically embedded links. On this basis, combined with the static and dynamic detection mechanisms, the paper establishes a Webpage trojan detection model. The experimental results show that the model can accurately detect various types of shell, encryption, deformation Webpage trojans, improving the detection efifciency of trojans.
展开▼
