以資訊隱藏分析爲基礎之惡意程式偵測技術

網際網路的普及使得緩衝區溢位攻擊成爲駭客最喜歡的攻擊技術之一，也成爲目前資訊安全領域中十分關注的問題。而利用緩衝區溢位進行攻擊程式也因而成爲防毒軟體防堵的焦點之一。有報導顯示，已有惡意的緩衝區溢位攻擊程式隱藏在圖檔內以躲避防毒軟體的偵測。資訊隱藏偵測技術則是以統計分析的方式來發掘隱藏訊息的存在。本論文目的即在提出一種以資訊隱藏分析爲基礎的惡意程式偵測技術來偵測隱藏在圖檔內的惡意程式碼。本技術同時結合支援向量機，提供自動化判斷機制，以解決使用資訊隱藏偵測技術時必須調整參數的困擾。實驗結果顯示，本技術可以有效的偵測出隱藏在圖檔內的惡意程式碼。本論文之研究成果可結合防毒軟體，以防止類似資安事件的發生。

關鍵字

資訊隱藏；藏密學；資訊隱藏分析；緩衝區溢位攻擊；支援向量機

並列摘要

The popularization of the Internet has made the buffer overflow attack become one of the favorite attacks used by hackers and the most concern in the information security field. Therefore, the buffer overflow attack also becomes one of the foci of the antivirus software nowadays. It is reported that there has been malicious buffer overflow codes embedded in the digital images to avoid the detection of anti-virus systems. Steganalytic techniques use statistical analysis to detect the existence of the embedded information. The purpose of this paper is to propose a steganalysis-based technique to detect the embedded malicious code. Meanwhile, the support vector machine (SVM) is integrated with the proposed technique to provide an automatic mechanism to solve the problem of tuning the parameters used in the proposed technique. Experimental results show that the proposed technique can effectively detect the malicious code embedded in the innocent images. The achievement of this study can be integrated with antivirus software to avoid this kind of information security accidents.