摘要
本篇論文採用端點(電腦本機)主動偵測與防禦的方式來處理殭屍病毒。對於這方面的研究，目前大都採用大數據分析的方式來對端點的行為作分析來判斷是否有殭屍病毒正在執行散佈的行為。但是因為偽陽性的問題，這些研究都無法達到100% 的準確率。另外他們的方式也只能判斷是否有殭屍病毒，而不能偵測到哪一支檔案是殭屍病毒。在本論文，我們提出一種新的方法:直接利用正常程式與殭屍病毒行為的差異來辨別可疑程式是否為殭屍病毒而不受其他雜訊的干擾。這新的方法準確率是100%。對於可疑程式而言，我們直接使用NetStat來抓取。在使用NetStat的狀況下，殭屍病毒嘗試連結失敗時，它會有SYN_SENT的訊號；反之，由於正常程式都知道欲連接IP位址，它只會有ACK的訊號，而不會有SYN_SENT的訊號。因此我們的偵測系統會在利用SYN_SENT的訊號來找出可疑病毒後，再利用正常程式與殭屍病毒執行一秒的IP成功連接數與失敗連接數的比例關係精準的將殭屍病毒給偵測出來。
並列摘要
This paper uses endpoint (computer local) active detection and defense to deal with zombie viruses. For research in this area, most current big data analysis methods are used to analyze the behavior of endpoints to determine whether a zombie virus is performing spreading behavior. However, due to the problem of false positives, these studies cannot achieve 100% accuracy. In addition, their method can only determine whether there is a zombie virus, but cannot detect which file is a zombie virus. In this paper, we propose a new method: directly using the difference in behavior between normal programs and zombie viruses to identify whether a suspicious program is a zombie virus without being interfered by other noise. This new method is 100% accurate. For suspicious programs, we directly use NetStat to capture them. When using NetStat, when the zombie virus attempts to connect and fails, it will have a SYN_SENT signal; on the contrary, because the normal program knows the IP address it wants to connect to, it will only have an ACK signal and not a SYN_SENT signal. Therefore, our detection system will use the SYN_SENT signal to find suspicious viruses, and then use the ratio between the number of successful IP connections and the number of failed connections in one second of normal program and zombie virus execution to accurately detect the zombie virus.