【作者】 李洋；

【导师】 沈波；

【作者基本信息】 北京交通大学 ， 电子与通信工程， 2012， 硕士

【摘要】 网页挂马是当前网络安全威胁中危害度非常高的一种,它会将木马注入到浏览网页的用户计算机中,从而达到窃取用户信息、控制用户计算机的目的。由于经济利益的驱动,这种网络威胁传播非常广泛,对网络社会造成了非常坏的影响。当前市场上有一些防护网页挂马的软件,它们对网页挂马的分析较为完善,能够迅速检测出已知特征的网页挂马。不过,新的挂马种类层出不穷,仅凭静态特征检测的手段,并不能高枕无忧。动态恶意行为检测虽能检测出一些未知特征的挂马,但却有着比较高的误报率,且会带来系统浏览延迟。出于社会影响考虑,这些公司非常看重低误报率,因此不能在实时监测时采用动态恶意行为检测的手段。这些软件对已知特征的挂马检测率非常高,但却不能检测未知特征,或多或少有一些不安全的隐患。本文在实际工作经验基础上,采集了大量相关数据,给出了一般的网络威胁(包括网页挂马)的个人防范手段和网站管理员对于各种挂马方式的防范手段,并设计了一个网页挂马监测系统。该系统中设计了黑名单和白名单数据库,能快速检测已知特征挂马网页。在监测已知特征挂马网页的基础上,利用SVM分类算法实现了对未知特征挂马网页的监测,并与其他分类算法进行了性能比较。该挂马监测系统力求用户体验,设置了安全策略模式和高效策略模式。两种策略在计算流程上有所不同,分别侧重安全性和浏览速度,在测试中均取得了预料中的理想效果。此外,该系统还包含了隐藏链接检测模块,可以检测网站源代码中隐藏链接的存在,为网站管理者提供一些修补漏洞的参考,也可以从侧面帮助网站管理者防范木马入侵。该系统能够成功地检测已知和未知特征挂马网页的存在,具有一定的学术研究意义。不过由于时间、样本数量、硬件设备条件有限,本设计在浏览速度、检测精度等方面仍有着一些遗憾,有待继续提高。相信在今后的研究中会更进一步地提高该系统的检测率和用户体验。更多还原

【Abstract】 Malicious Web pages is a kind of destructive Web threats. It can help attackers to steal information from other Web users, or control other users’computers. Malicious Web pages has been widespread in the world, and has been made a large of economic losses to society. There are much software in the market now. These software companies analysis characteristics of malicious Web pages well, so their software can detect the known malicious Web pages quickly. However, the new characteristics emerging one after another, so we need to detect those unknown characteristics. The trending malicious act detecting method can detect some unknown malicious Web pages, but it also means high-level rate of false alarm and system showdown. However, the Web security companies focus on low-level rate of false alarm more, so that their software can’t detect unknown characteristics of malicious Web pages.Based on working experience, this thesis offers some security precautions of Web threats, and presented a system of detecting malicious Web pages. This system designs black list and white list, so it can detect malicious Web pages quickly. This system use SVM algorithm to detect unknown characteristics of malicious Web pages, and has better effect than other sorting algorithm in test. This system has two modes:security mode and high-efficiency mode. These methods focus on different points. Security mode detects all Web pages in detail, and high-efficiency mode visit Web page faster. On the other hand, this system has a hidden links detecting module. This module can give some reference to Website owner about flaws of their Website, and also help Website owner to against Trojan and other Web threats.This thesis has some significant of academic research. However, because of the limitation of time, sample size and hardware, there are also some regrets remain. The detection rate and user experience will be promoted in the future.更多还原