跳到主要內容

簡易檢索 / 詳目顯示

回結果列表
研究生： 簡溢成
Yi-cheng Chien
論文名稱： 網頁惡意程式碼偵測之研究
A Study of Web-Based Malicious Code Detection
指導教授： 吳中實
Jung-shyr Wu
口試委員:
學位類別： 碩士
Master
系所名稱： 資訊電機學院 - 通訊工程學系在職專班
Executive Master of Communication Engineering
畢業學年度： 97
語文別： 中文
論文頁數： 57
中文關鍵詞： 程式碼偵測 、惡意網頁
外文關鍵詞： Malicious URL, Malicious Code Detection
相關次數： 點閱：3  下載：0 
分享至:
查詢本校圖書館目錄 查詢臺灣博碩士論文知識加值系統 勘誤回報

    • 隨著網際網路服務的興起與發展，使用Internet已經變成我們生活中不可換缺的工具。例如我們可以透過web 連到網路商店購買物品、到網路銀行進行轉帳匯款等。也因為網路的發達改變了一般人的生活習慣，幾乎所有的事情都可以透過網路來完成。
    網路使用的越頻繁，其網路安全就顯得更加的重要，隨著網路使用方式的行為改變，透過網路進行攻擊的手法也跟著改變，最新的攻擊手法則是透過使用者參觀造訪網站時，隱藏式進行惡意程式下載並利用瀏灠器的漏洞或是電腦裡其他程式的漏洞來執行程式，破壞使用者的電腦安全防護並竊取個人機密資料。
    為了避免使用者在不知不覺連結到有問題的網站下載惡意程式或是遭受插入惡意程式碼的攻擊，本篇主要是希望透過Web page內容分析的方式加上評分系統來進行判定，並利用智慧判斷方式收集惡意程式來源協助判斷，藉此找出可能造成使用者安全疑慮的連結或是網頁內容，盡可能保護一般使用者上網的安全。

    With the rise of Internet services and development, the use of Internet has become the indispensable tools in our lives. For example,we can purchase items through the Internet store and transfer remittance on thenetwork. In the trend of development of the Internet which has changed the habits of ordinary people, you may find that almost everything could be done through the Internet.
    The more frequent using the Internet, the more important emphasizing the problems of the security of the Internet. With the changes of the ways of using the Internet, methods of attacking through the Internet altered than before. The latest way of attacking is downloading the malicious programs as users surfing the Internet, then installing the programs through the vulnerability of the browser or other programs to undermine the users’ computer and to steal the personal confidential information.
    In order to prevent the users from being unknowingly attacked by malicious programs for surfing the questionable website, this essay is to help users to judge the questionable websites or pages by analyzing the contents of web page. Besides the web page content analysis scoring system, I also collect the sources of malicious programs to find out the questionable link or
    webpage to protect the security of using the Internet.

    中文摘要...................................................................... i Abstract ..................................................................... ii 誌 謝.................................................................... iii 目 錄..................................................................... iv 圖 目 錄 ..................................................................... vi 表 目 錄 .................................................................... vii 第 一章 序論................................................................ 1 1.1 前言..................................................................................................................................1 1.2 研究動機.........................................................................................................................2 1.3 論文架構.........................................................................................................................5 第二章 相關背景及研究.................................................... 7 2 . 1 2 0 0 0 年前的攻擊方式.................................................................................................7 2 . 2 2 0 0 0 年後的攻擊手法.................................................................................................8 2 . 2 . 1 利用郵件夾帶病毒或木馬攻擊...................................................................8 2 . 2 . 2 利用郵件夾帶病毒或木馬的連結程式.....................................................9 2 . 2 . 3 免費小程式或是非法程式破解.................................................................10 2 . 3 網路攻擊手法的歷史變革....................................................................................... 11 2 . 4 網路安全的迷思.........................................................................................................14 2 . 4 . 1 迷思一： 安裝防毒防駭軟體即安全？ ...................................................14 2 . 4 . 2 迷思二： 不去非法網站即安全？ ............................................................15 2 . 5 網頁型攻擊方式研究................................................................................................18 2 . 5 . 1 吸引人的主題.................................................................................................18 2 . 5 . 2 A D 廣告攻擊.....................................................................................................22 第三章 網頁型攻擊的內容研究............................................ 24 3 . 1 網頁攻擊如何進行? ..................................................................................................24 3.2 iframe ............................................................................................................................24 3 . 2 . 1 語法位置異常.................................................................................................25 3 . 2 . 2 長度寬度為零.................................................................................................25 3 . 2 . 3 相同i f r a m e 重覆性......................................................................................26 3 . 3 攻擊混淆手法..............................................................................................................27 3 . 3 . 1 利用語法分割i f ra me 網址........................................................................27 3 . 3 . 2 編碼隱藏語法.................................................................................................28 3 . 3 . 3 特殊字元取代法.............................................................................................29 第四章 解決方式.......................................................... 31 4.1 樣本收集.......................................................................................................................31 4 . 1 . 1 D r i v e - b y D o w n l o a d ......................................................................................32 4 . 2 自動評分系統..............................................................................................................33 4 . 3 資料庫系統...................................................................................................................34 4 . 3 . 1 H o n e y P o t C l i e n t 系統建立.......................................................................34 4 . 3 . 2 H o n e y P o t Client System ..........................................................................36 4.3.3 Auto Analysis System ...............................................................................37 4 . 3 . 4 特殊S c r i p t 語法收集.................................................................................38 4.4 數據分析.......................................................................................................................39 4 . 4 . 1 i f r a m e 偵測.....................................................................................................39 4 . 4 . 2 S c r i p t 偵測.....................................................................................................41 4 . 4 . 3 i f r a m e + S c r i p t 偵測................................................................................42 4 . 4 . 4 D a t a b a s e 偵測................................................................................................43 第五章 結論............................................................... 45 5.1 未來工作.......................................................................................................................45 5.2 結論................................................................................................................................45 參考文獻..................................................................... 46

    [1]RFC　2068,＂Hypertext　Transfer　Protocol”, http://www.faqs.org/rfcs/rfc2068.html
    [2]Niels　Provos,　Google,Inc.,”The　Ghost　In　The Browser　Analysis　of　Web-based　Malware”,July　2007
    [3]Niels　Provos,　Google,Inc.,”All　Your　iframes　Point　to　Us”,Feb　2008
    [4]MicroSoft,”SQL　Injection”,　http://www.microsoft.com/taiwan/sql/SQL_Injection.htm,Jun　2002
    [5]MicroSoft,”SQL　Injection”,　http://www.microsoft.com/taiwan/sql/SQL_Injection_G1.htm,Jun　2002
    [6]Symantec,　http://www.symantec.com
    [7]Zone-H,　http://www.zone-h.org/
    [8]ClientHoneyPot　Project,　https://www.clienthoneynet.org/about.html

    QR CODE
    :::