利用程式背景執行資訊偵測間諜程式

Detect Spyware by Checking the Modification of System Information

吳耿宏(Geng-Hong Wu)

指導教授 ： 田筱榮

中原大學/工學院/資訊工程研究所/碩士(2006年)

https://doi.org/10.6840/cycu200600342

摘要

隨著網路與電腦的應用越來越多，有越來越多的資料是存放於電腦中。資料的竊取對電腦使用者而言，是很大的問題。而間諜程式就是目前相當嚴重的一種竊取資料的方法。間諜程式利用誘騙的方式，隱密的進入系統中，可能開啟後門供攻擊者任意使用被害者電腦。也可能是鍵盤或資訊記錄器，可以記錄被害者的帳號與密碼。最麻煩的地方是間諜程式有著隱密的特性，要直接發現間諜程式並且移除，是很不容易的事。
偵測方法主要有兩種方式，特徵比對與異常偵測。特徵比對方式在準確率方面有較好的表現，但是有特徵資料庫更新需要時間的缺點。異常偵測利用特徵的選取可以發現未知的間諜程式，但是誤判率也較高。所以我們採取兩種方法的結合，利用程式一開始執行時的行為異常當辨識的特徵。這個方法主要建構於兩個重點之上，第一個是監視系統中與自動啟動程式相關的參數被設定與修改的情況，另一個則是記錄系統中檔案的增加與修改情況，區分出正常程式、間諜程式或是包含間諜程式的正常程式的檔案安裝情況。在我們的實驗中可以發現，這個方法同時具有特徵比對的準確率，對於新的間諜程式也可以有效的發現。

關鍵字

間諜程式 ； 資訊安全 ； 偵測間諜程式

並列摘要

As more and more services are provided through the use of computers and computer networks, the security of the data stored in computers as well as that of the identity information of users given out when services are accessed have become major concerns to every computer user. With the nature of self-hiding, spywares pose one class of the most serious and difficult to be detected threats to these concerns. Currently, two types of detection practices are adopted in today’s spyware detection systems: the misuse-detection type based on signature patterns of code streams and the anomaly-detection one based on statistic models of the behaviors of executables. The former has better accuracy in detection results, yet it also inherent the problem of time lag in new spyware signature discovering and updating. On the other hand, the latter is able to detect new spywares, but suffers from the accuracy of detection result. In this study, we proposed a novel detection method. Based on the nature of spywares, the execution of a spyware can be distinguished from the execution of a normal program by the differences in the process initiation procedure. As shown in the experiments, the proposed scheme is able to recognize spywares known to the signature-based detection systems with the same accuracy. In addition, it is also capable of identifying new spywares as well.

並列關鍵字

spyware ； spyware detection ； computer security

參考文獻

[6]. Sherman S.M. Chow ,Lucas C.K. Hui,S.M. Yiu,K.P. Chow,Richard W.C. Lui,”A generic anti-spyware solution by access control list at kernel level” , Journal of Systems and Software Volume 75 , Issue 1-2 Special issue: Software engineering education and training , pp: 227 - 234 , February 2005

[4]. Weidong Cui and Randy H. Katz, “BINDER: An Extrusion-Based Break-In Detector for Personal Computers”, USENIX 2005 Annual Technical Conference, pp: 363–366 , April 2005.

[10]. Neveen Farag Awad, Kristina Fitzgerald , “The deceptive behaviors that offend us most about spyware”, Communications of the ACM Volume 48 , pp:55-60 , Number 8 2005

[13]. Alexander Moshchuk, Tanya Bragin, Steven D. Gribble, and Henry M. Levy , “ A Crawler-based Study of Spyware on the Web ” , Proceedings of the 13th Annual Network and Distributed System Security Symposium (NDSS 2006), February 2006

[14]. PC-cillin AntiVirus software http://www.trend.com.tw