木马检测与防护技术的发展
Study of Trojans Detection and Prevention Technology
DOI: 10.12677/CSA.2015.512054, PDF, HTML, XML, 下载: 2,154  浏览: 6,896 
作者: 吴少华, 胡勇：四川大学电子信息学院，四川 成都
关键词: 木马；伪装技术；进程隐藏；通信协议；免杀；木马检测；Trojan； Masquerading Technology； Process Hidden； Communication Protocol； Avoid Killing； Trojan Detection
摘要: 通过对大量当前流行的windows木马程序进行逆向，分析木马在伪装技术、程序隐藏方式、进程隐藏方式、通信方式和免杀手段上所使用的各种技术，并结合当前主流的安全软件对木马的检测效果和检测方式，提出对抗木马新技术的方法。
Abstract: Based on reverse analysis of many current popular Windows’ Trojans behavior, the new technolo-gies used by Trojans were summarized, including program hidden, process hidden, communication pattern and means to avoid killing. Combined with the current mainstream security software to detect the Trojan, some new technologies and opinions against the Trojan threat were present.
文章引用：吴少华, 胡勇. 木马检测与防护技术的发展[J]. 计算机科学与应用, 2015, 5(12): 429-435. http://dx.doi.org/10.12677/CSA.2015.512054

参考文献

[1] [1] 刘澜, 高悦翔. 木马隐藏技术的研究与分析[J]. 通信技术, 2010(4): 78-80.
[2] 谢宗仁. 木马原理分析与实现[D]. 山东大学, 2009.
[3] 梅登华, 林耀通. 基于Multi-Agent的木马模型设计[J]. 电子技术应用, 2008, 34(5): 138-140.
[4] 许国顺. 木马攻击与防范技术研究[D]. 成都: 四川大学, 2006.
[5] 新型木马入侵方式显卡也会感染病毒[EB/OL]. http://vga.zol.com.cn/521/5216200.html
[6] 修改硬盘固件的木马探索方程式(EQUATION)组织的攻击组件[EB/OL]. http://www.antiy.com/response/EQUATION_ANTIY_REPORT.html
[7] 谢海. 基于FPGA的硬件木马检测[D]. 广州: 广东工业大学, 2013.
[8] Ngo, X.T., Bhasin, S. and Danger, J.-L. (2015) Linear Complementary Dual Code Improvement to Strengthen Encoded Circuit against Hardware Trojan Horses. 2015 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), Washington DC, 82-87.
[9] Khaleghi, B., Ahari, A. and Asadi, H. (2015) FPGA-Based Protection Scheme against Hardware Trojan Horse Insertion Using Dummy Logic. IEEE Embed-ded Systems Letters, 7, 46-50.
http://dx.doi.org/10.1109/LES.2015.2406791
[10] Android平台下二维码漏洞攻击杂谈[EB/OL]. http://www.wtoutiao.com/p/17472Js.html
[11] Android间谍软件可劫持设备并伪装成已关机以便继续监听[EB/OL]. http://www.cnbeta.com/articles/372017.htm
[12] 警惕“不死”木马逆袭安卓手机[EB/OL]. http://article.pchome.net/content-1699805.html
[13] 张建国. “顽固木马”对抗的技术剖析[J]. 计算机与网络, 2015(Z1): 72.
[14] 2015年末最流行手机木马分析报告[EB/OL]. http://news.163.com/15/1209/15/BADGDM2Q00014JB6.html
[15] 360公布十大手机恶意程序木马伪装微信消息传播[EB/OL]. http://mobile.people.com.cn/n/2014/0212/c183175-24338339.html
[16] Gudipati, V.K., Vetwal, A. and Kumar, V. (2015) Detection of Trojan Horses by the Analysis of System Behavior and Data Packets. 2015 IEEE Long Island Sys-tems, Applications and Technology Conference (LISAT), Farmingdale, 4.
[17] 赵玉明. 木马技术揭秘与防御[M]. 北京: 电子工业出版社, 2012.