臺灣博碩士論文加值系統

隨著3G 網路的普及智慧型手持裝置的使用出現快速的成長，近幾年民眾產生逐漸增加對於網路依賴性。但針對智慧型手機發動攻擊的惡意程式的數量，於過去之三年已增加數倍之多。近期雲端服務供應商採用污點檢驗（Taint checking，TC）作為應用服務上架前之檢測方法以確保用戶之資訊安全。本研究針對雲端應用程式提出一個資訊流之動態污點傳播分析模型，其整合加權生成樹(Weighted Spanning Tree)、污染標記方法與工具，以解決資安漏洞與動態污點追踪的問題;，在分析模型中，假設是在開放式的行動網路下，隨意選擇惡意程式(污染源)與系統漏洞(受害端)假設下，以檢測資訊污染源與特定的網路應用程式及雲端服務漏洞之間的資訊流的污點傳播的行為與範圍。
在測試案例中，以委託的三方開發之Android的程式執行污點檢驗情境來分析APP程式、後台雲端服務內部模組與網路污染源連線之資訊交換與風險。透過概率風險指標客觀評估每一可能的污染路徑風險，協助防衛者評估惡意程式威脅的污染範圍和估計造成的損失。

Due to the popularity of 3G network and the fast growing of mobile device, it leads to the increasing situations of network-dependent for people. However, the number of malware for smartphone attacks is several times the number of the previous one in the past three years. To guarantee the mobile security of cloud computing services, cloud service providers (CSPs) use Taint Checking (TC) approaches to examine how a developing cloud app uses sensitive information before deploying an app. Accordingly, this paper proposes a taint propagation analysis model incorporating a weighted spanning tree analysis scheme to track data with taint marking using several taint checking tools. In performing malware threat analysis against unspecified malware attacks, CSPs can use a TC approach for tracking the spreads and scopes of information flows between attack sources (malware) and detect vulnerabilities of targeted network applications. To verifiy the proposed model, we perform android programs using dynamic taint propagation to analyse the spread of and risks posed by suspicious apps were connected to the cloud computing server. For probabilistic analysis of taint propagation, risk and defence capability are used for each taint path for assisting a defender in recognising the attack results against network threats caused by malware infection and estimate the losses of associated taint sources.

中文摘要 i
英文摘要 ii
誌謝 iii
目錄 iv
一、 緒論 1
1.1 研究背景 1
1.2 研究動機及目的 2
1.3 論文章節架構 3
二、 文獻探討 5
2.1 行動惡意軟體 5
2.2 惡意行為之檢測方法 8
2.3 污點分析 11
2.4 加權生成樹 12
三、 研究方法 14
3.1 研究架構 14
3.2 以污點資料分析之數據流模式 15
3.3 動態污點傳播數學分析模式 18
3.4 污點傳播規則之關聯分析 19
3.5 以加權生成樹分析污染傳播途徑 21
3.5.1 決定污染範圍 21
3.5.2 受污染模組的風險評估 22
3.5.3 污點分析模式虛擬代碼 23
四、 實驗與驗證 25
4.1 行動裝置污點資料分析環境建置 25
4.2 污染源分析 33
4.3 污點傳播規則之關聯分析 34
4.4 以加權生成樹分析污染傳播途徑 38
4.5 決定污染範圍 41
4.6 受污染模組風險評估 42
五、討論 44
六、結論 48
參考文獻 49

[1] Wikipedia, taint checking, available at: http://en.wikipedia.org/wiki/Taint_checking.
[2] J. A. Bondy and U. Murthy, Graph Theory with Applications. New York: Elsevier,1976.
[3] Droidbox,Droidbox android application sandbox - googleproject hosting.http://code.google.com/p/droidbox/, 2013.Accessed Dec. 10, 2013.
[4] Erika Chin,Analyzing Inter-Application Communication in Android,2011.
[5] APIMonitor,https://code.google.com/p/droidbox/wiki/APIMonitor,2012.
[6] C.E. Pelaez and J. Bowles, “computer viruses,” In Proceedings Twenty-Third Southeastern Symposium on System Theory, vol. 23, March 1991, pp.513-517.
[7] G. McGraw and G. Morrisett, “Attacking Malicious Code: A report to the Infosec
Research Council,” IEEE Software, vol.17, no.5, 2000, pp. 33-41.
[8] D. Zenkin, “Fighting against the invisible enemy,” Computers & Security, vol. 20, no. 4, 2001,pp. 316-21.
[9] Michael Becher and Ralf Hund, “Kernel-Level Interception and Applications on Mobile Devices,” Technical Report, Department for Mathematics and Computer Science, University of Mannheim, 2009.
[10] Heng Yin, Dawn Song, Manuel Egele, Christopher Kruegel, and Engin Kirda, ”Panorama Capturing System wide Information Flow for Malware Detection and Analysis,”14th ACM Conference on Computer and Communications Security, 2007.
[11] S.A.Khayam and H.Radha, “A topologically-aware worm propagation model for wireless senor networks,” In Proceeding. of the 25th IEEE International Conference on Distributed Computing Systems Workshops, Vol. 15, No. 5, 2005, pp. 210-216.
[12] J. W. Mickens,B. D. Noble.Modeling epidemic spreading in mobile environments.In Proceedings of the 4th ACM workshop on Wireless security,2005
[13] Abhijit Bose, Xin Hu, Kang G. Shin, and Taejoon Park, ”Behavioral Detection of Malware on Mobile Handsets,” MobiSys, 2008.
[14] J. Newsome and D. Song, Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software, Carnegie Mellon University, Research Showcase @CMU, 2005.
[15] H. Mannila, H. Toivonen, and I.A. Verkamo Discovery of frequent episodes in event sequences, Data Mining and Knowledge Discovery 1(3), 1997, pp.259-289.
[16] Dynamic Taint, D.Song, M. Egele, C. Kruegel, and E.Kirda, Panorama: capturing system wide information flow for malware detection and analysis. In Proceedings of the 14th ACM Conference on Computer and Communications Security, 2007, pp. 116-127.
[17] H.C. ,Kim, A.D. Keromytis, M. Covington, R.Sahita, Capturing Information Flow with Concatenated Dynamic Taint Analysis, iN Proceedings: International Conference on Availability, Reliability and Security, 2009, pp.355-362.
[18] SpanningTree,http://www.csie.ntnu.edu.tw/~u91029/SpanningTree.html.
[19] R. P. Grimaldi. Discrete and Combinatorial Mathematics: An Applied Introduction. Addison-Wesley, 3rd edition, 1994.
[20] MinimumSpanningTree.http://en.wikipedia.org/wiki/Minimum_spanning_tree.
[21] Dijkstra Algorithm,http://en.wikipedia.org/wiki/Dijkstra%27s_algorithm.
[22] Prim Algorithm,http://en.wikipedia.org/wiki/Prim%27s_algorithm.
[23] Kruskal Algorithm,http://en.wikipedia.org/wiki/Kruskal%27s_algorithm.
[24] Valgrind, http://valgrind.org.
[25] G. Portokalidis, A. Slowinska, and H. Bos. Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation. SIGOPS Oper. Syst. Rev., 40(4), 2006.
[26] P. Wang, K.M. Chao, C.C. Lo, W.J. Chao, Using Taint Propagation Checking for Threat Analysis of Cloud Services, IEEE International Conference on e-Business Engineering, 2014, pp.185-190.
[27] O. Tripp, M. Pistoia, S. J. Fink, M. Sridharan, O. Weisman, TAJ: effective taint analysis of web applications In conference on Programming language design and implementation, pp. 87-97, 2009.
[28] SpanningTree, https://en.wikipedia.org/wiki/Spanning_tree.
[29] Attack Graph, http://blog.yilang.org/2015/01/blog-post.html
[30] TEMU, http://bitblaze.cs.berkeley.edu/temu.html.
[31] 姜琇森,賴建源,楊智傑,宋光凱,行動平台上手機病毒的偵測技術評估之研究,第十一屆電子化企業經營管理理論暨實務研討會, 2010, pp. 378-388.
[32] 吳世旭,手機病毒威脅與傳播之研究,樹德科技大學資訊工程系碩士論文, 2008.
[33] 彭添鴻,藍牙型手機病毒之傳播模擬與防疫策略初探,交通大學資訊學院資訊學程碩士論文, 2008
[34] 陳志遠,手機病毒行為分析與偵測之研究,大葉大學資訊管理學系碩士論文, 2009.
[35] 王宇治,行動裝置病毒知識本體雛型之建構-以Android系統為例,崑山科技大學資訊管理學系碩士論文, 2014.
[36] 曾聖嘉, Android 應用程式安全性分析-後門程式威脅偵測研究,元智大學, 2011.
[37] 黃能富,高迦南,張詠承,廖宜芳,黃俞嘉,類HTTP 型傀儡網路之 NIDS 特徵碼自動產生系統的設計與實作,The Anti-Botnet Project of TANet, 2011.
[38] 劉恩榜,Android 上的殭屍網路攻擊偵測,交通大學資訊科學與工程研究所碩士論文, 2011.
[39] 陳君彥,紀佳佑,張君豪,李原嘉,廖于文,陳俊孙,行動安全：智慧型手機惡意軟體偵測與沙箱機制的應用,Network Security Practices - Attack and Defense Project Report, 2009.
[40] 張中一, 新世代生成樹協定的簡介暨應用探討－多重生成樹協定,CCL TECHNICAL JOURNAL,第113期, pp. 113-121, 2005.
[41] 林愷庭, Android智慧型手機應用程式逆向工程之研究,中央警察大學資訊管理研究所碩士論文,2012.
[42] 謝維揚, 以存取以及網路洩漏隱私資料行為為基礎的android惡意程式行為偵測,國立交通大學網路工程研究所碩士論文,2013.
[43]孫建興, 行動裝置上惡意軟體行為偵測之究-以 Android 為例,大同大學資訊經營研究所碩士論文,2012.
[44]蘇民揚,張文銓, 使用靜態分析與機器學習以偵測Android惡意程式,TANET台灣網際網路研討會,2013.
[45]蔡立倫, 整合靜態分析及動態分析結果 作為機器學習標準的 Android惡意程式偵測系統, 國立交通大學網路工程研究所碩士論文,2014,
[46] 劉志成,薑波,一種最小生成樹演算法設計,Intelligent Information Management,2009,pp.60-63.
[47] 方冠傑,以最小生成樹為基礎的醫學影像切割法,交通大學資訊科學與工程研究所碩士論文, 2004.
[48] 周玉林,最小生成樹與次小生成樹上的算法分析與設計,上饒師範學院學報, Vol. 25, No. 3, 2005, pp. 80-82.
[49] 鐘健元,最小直徑最小成本生成樹之分析, 國立臺灣大學電機資訊學院資訊工程學研究所碩士論文,2008.
[50] 邱彥達,植基於遊戲式學習的Prim及Dijkstra最小生成樹, 中華大學資訊管理學系研究所碩士論文,2011.
[51] 陳嘉玫,以汙染傳遞為基礎之行動軟體威脅行為偵測,第六屆台灣區Botnet 偵測與防治技術研討會(BoT2014)，2014年12月26日。
[52] 任霏霏，莊洪林，吳理發，潘璠，跨主機動態污點跟踪技術研究，計算機工程，第39卷、第3期，2013.
[53] 王鐵磊，Research on Binary-Executable-Oriented Software，北京大學信息科技技術學院，博士論文，2011.
[54] 王平,林文暉,周宇軒,呂仁貴,雲端運算虛擬主機之攻擊模擬與分析,資訊安全通訊, Vol.19, No.2, 2012, pp.1-16.