基於電腦資安攻防之惡意程式研析與實作

MALICIOUS PROGRAM ANALYZER AND IMPLEMENTION BASED ON THE COMPUTER INFORMATION SECURITY ATTACK AND DEFENCE

呂開明(Kaimin Lu)

指導教授 ： 陳建華

大同大學/電機資訊學院/通訊工程研究所/碩士(2006年)

摘要

近年來網路的攻擊活動讓我們防不勝防，這其中以木馬程式危害個人隱私最甚。許多電腦用戶所仰賴的掃毒程式並不能提供他們甚麼保證，因為要偵測木馬程式實在十分不容易，因此，我們希望藉由本篇論文研究木馬程式所使用的技術，進而瞭解木馬程式的特性，從而達到反制木馬程式的目的，並進一步分析木馬程式與作業系統的弱點的關係，從而加強作業系統的安全掌控。 在資料完成蒐集及研析後，我們將根據木馬程式的特性及所需的規格，實作出一個木馬程式以測試相關商用防毒工具及防火牆之檢測能力

關鍵字

遠端遙控程式 ； 惡意程式

並列摘要

Current commercial antivirus software could not guarantee much, because it is not easy to detect the Trojan program. In this thesis, we focus on the characteristics of the Trojan programs and try to realize their key techniques and the correlation between them and the operating system. The system weakness for invasion are analyzed and the finding can be used to design more secure operation system. After the data collection and analysis, we build a Trojan program on the basis of the regular characteristics and test it against both the commercial antivirus softwares and firewalls.

並列關鍵字

win32 PE format ； win32 Api

參考文獻

[1] W. A. Arbaugh, D. J. Farber, and J. M. Smith, “A secure and reliable bootstrap architecture,” In Proceedings of 1997 IEEE Symposium on Computer Security and Privacy, pp. 65-71, 1997.

[8] R. P. Goldberg, “Survey of virtual machine research,” IEEE Computer, pp. 34–45, June 1974.

[9] D. Gollmann, Computer Security, 2nd edition. John Wiley and Sons, Inc., January 2006.

[16] G. J. Popek and R. P. Goldberg, “Formal requirements for virtualizable third generation architectures,” Communications of the ACM, vol. 17, no. 7, pp.412-421, July 1974.

[19] Walter Oney, Systems Programming for Windows 95 with Disk, July 1996.