| 本文已被：浏览 6774次 下载 17153次 |
码上扫一扫！ |
|
|
| 恶意代码演化与溯源技术研究 |
|
宋文纳1,2, 彭国军1,2, 傅建明1,2, 张焕国1,2, 陈施旅1,2
|
|
1.空天信息安全与可信计算教育部重点实验室(武汉大学), 湖北 武汉 430072;2.武汉大学 国家网络安全学院, 湖北 武汉 430072
|
|
| 摘要: |
| 恶意代码溯源是指通过分析恶意代码生成、传播的规律以及恶意代码之间衍生的关联性，基于目标恶意代码的特性实现对恶意代码源头的追踪.通过溯源可快速定位攻击来源或者攻击者，对攻击者产生一定的震慑打击作用，具有遏制黑客攻击、完善网络安全保障体系的重要作用和价值.近年来，网络安全形势愈加严峻，归类总结了学术界和产业界在恶意代码溯源领域的研究工作，首先揭示了恶意代码的编码特性以及演化特性，并分析这些特性与溯源的关系；然后，分别从学术界和产业界对恶意代码的溯源技术和研究进行梳理，同时对每个溯源阶段的作用以及影响程度进行了讨论，并对目前恶意代码的溯源对抗手段进行分析；最后讨论了恶意代码溯源技术面对的挑战和未来的发展趋势. |
| 关键词: 恶意代码溯源 演化 对抗 家族聚类 恶意代码检测 |
| DOI：10.13328/j.cnki.jos.005767 |
| 分类号:TP311 |
| 基金项目:NSFC-通用技术基础研究联合基金（U1636107）；国家自然科学基金（61373168，61332019） |
|
| Research on Malicious Code Evolution and Traceability Technology |
|
SONG Wen-Na1,2, PENG Guo-Jun1,2, FU Jian-Ming1,2, ZHANG Huan-Guo1,2, CHEN Shi-Lü1,2
|
|
1.Key Laboratory of Aerospace Information Security and Trust Computing(Wuhan University), Ministry of Education, Wuhan 430072, China;2.School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China
|
| Abstract: |
| The traceability of malicious code refers to the tracking of the source of malicious code based on the characteristics of the target malicious code by analyzing the rules of the generation and propagation of malicious code and the correlation of derivation among malicious codes. The tracking technology can quickly locate the source of attacker or attacker, which would make a deterrent effect to the attacker. It has the important role and value in curbing deterring hacking attacks and improving the network security system. In recent years, the network security situation has become more and more severe. This study categorizes and summarizes research work in the academic and malicious code traceability field. First, the coding characteristics and evolutionary characteristics of malicious codes are revealled, and the relationship between these characteristics and traceability is analyzed. Then, the traceability techniques of malicious code are reviewed and the role and impact of each traceability phase are discussed in the industry and academia. Also analyzed is the level of confrontation of traceability of current malicious code. Finally, the challenges and the future development trend faced by malicious code tracing technology are discussed. |
| Key words: malicious code traceability evolution confrontation family clustering malicious code detection |
