论文部分内容阅读
Web网站已成为黑客的主要攻击目标。基于代码特征签名对网页恶意代码进行检测的方法特征库的维护工作量较大,而基于Honeypot的方法效率较差。黑客在植入网页恶意代码时往往使代码在显示效果上不易被浏览者发现。该文针对这一特征设计了一种检测方法,在对各种恶意代码植入方法分析的基础上,归纳出了6种植入特征,并实现了一个原型系统。原型系统实现了一个包含脚本解释执行功能的Web爬虫来获取目标页面,通过HTML解析获得可供检测的标签,将其与植入特征进行匹配以发现恶意代码。与传统检测方法相比,该方法所依赖的特征数量少,检测效率高。对60个真实站点的检测结果表明,原型系统仅有2.63%的漏报率和1.99%的误报率。
Web sites have become the main target of hackers. The method of detecting malicious code on the web page based on the signature of the code has a great workload to maintain the feature database, but the Honeypot-based method is not efficient. Hackers in the implantation of malicious code on the web often make the code in the display is not easy to be seen by the viewer. This paper designs a detection method for this feature. Based on the analysis of various malicious code implantation methods, six kinds of implant features are summarized and a prototype system is implemented. The prototype system implemented a web crawler that included a script-interpreter executive to retrieve the target page, parse the tag for inspection via HTML parsing, and match it to the implanted features to detect malicious code. Compared with the traditional detection methods, the method relies on fewer features and high detection efficiency. Test results on 60 real sites showed that the prototype system had only a 2.63% false negative rate and a false positive rate of 1.99%.