论文部分内容阅读
随着互联网的不断发展,网页木马(drive-by download)这一新形态的攻击形式已经成为了互联网的主要威胁之一,并成为了恶意代码传播最主要的途径。针对网页木马作为一种特殊的恶意代码形式,传统的检测机制,无论是基于内容的(如网络入侵检测系统、防病毒软件),还是基于行为的(如防火墙、主机入侵检测系统),都不能对其进行有效的检测。因此,如何对这一攻击形态进行有效的检测与防护已成为了网络安全领域的研究热点之一。本文以提高客户端对网页挂马的检测和防护能力为目标,围绕网页挂马的攻击本质及对其进行检测的关键技术展开研究。
As the Internet continues to evolve, a new form of web-based drive-by-download attacks has become one of the major threats to the Internet and has become the primary means of spreading malicious code. For Web Trojan As a special form of malicious code, the traditional detection mechanism, whether based on content (such as network intrusion detection system, anti-virus software), or based on the behavior (such as firewall, host intrusion detection system), can not To conduct an effective test. Therefore, how to effectively detect and defend this attack pattern has become one of the hot topics in the field of network security. This paper aims to improve the detection and protection ability of the client on the webpage linked to the horse, and studies the nature of the attack on the webpage linked to the horse and the key technologies for its detection.