- 學位論文
System Design of Active Detection for Alternate Data Streams in the NTFS File
System Design of Active Detection for Alternate Data Streams in the NTFS File
摘要
由於網路的帶動，資訊應用在網路上無遠弗屆的發展，增加了許多便利性，但資訊的隱私、保密安全是一項考驗，機密或隱私資訊遭到竊取，對政府來說是國家安全等級的危害，對企業則是商業利益與商譽的損失，無論是政府、企業或個人使用者，都必須重視資訊安全議題。近年來惡意程式感染率也逐年大量快速的增長，使得政府、企業及個人在面對隱私資料外洩事件，不得不重視所帶來的損失。由於NTFS具有可變動式資料串流的特性，此特性可以在NTFS檔案系統底下隱藏任何格式的資料。常用的dir命令模式指令與Explorer都無法看到其隱藏的資料，因此具有資訊安全的威脅。攻擊者可以利用惡意軟體去隱藏在受害者的作業系統底下，對於管理者和一般使用者而言，這是不易於去發現其所在。很容易在不知情的狀況下，機密隱私性資料安全受到嚴重的威脅。而可變動式資料串流除了不易被發現、容易創造等特性，還可透過壓縮檔案的形式傳輸至網際網路，更有可能造成阻斷式服務攻擊。為了解決NTFS檔案系統本身的安全威脅，本研究主要提出一個新的程序方法解決此問題，使用統一塑模語言來設計系統架構，並實際開發主動式偵測系統。透過此應用系統，可以彌補防毒軟體在偵測惡意可變動式資料串流的不足並提升使用者的系統安全性。
關鍵字
無資料並列摘要
After the development of the network, the information can reach anyone anywhere at any time on the Internet. It increases more convenience. At the same time it becomes more harmful for the information privacy and confidentiality security. It is because that the confidential or private information can be stolen easily. To governments, this concern is about the national security level. To businesses, it could cause losses of their benefits and reputation. Nowadays, the information security is regarded as the most important issue for governments, businesses, and also individual users. Unfortunately, the malware increases rapidly every year. Since a large number of malwares spread via the Internet, it has made users face privacy data leakage incidents. By using alternate data streams (ADSs) features in NTFS, the files can be hidden in the operating system. Especially, the attackers will embed malware to the victims’ system by using ADSs when the attacker launches attack. Windows “Explorer” and the “dir” command-line application can’t list ADSs. For the managers and general users, it is hard to find it in this situation. The confidential or private information is under a serious threat in an unknown condition. On the other hand, the ADSs can be transmitted to the other on Internet by the compressed file. Thus, ADSs have threats of information security. In order to solve the hidden attack problems of the malicious program via the ADS, we will propose a method with new procedure, design the system architecture and process by using unified modeling language and develop active detection system for ADS. It can compensate for the lack of anti-virus software that detect malicious ADSs and enhance the system security for small and medium-sized enterprises and general users.