臺灣博碩士論文加值系統

木馬病毒是現今網路威脅的主因，藉由木馬病毒潛伏在被害者主機上，竊取使用者資訊，危害使用者的資訊安全。目前防毒軟體所使用的特徵庫，雖然偵測已知木馬病毒有非常高的偵測率，但是對於未知木馬病毒偵測率卻非常低。因此本研究提出藉由Windows Api來偵測木馬病毒，藉由木馬病毒之間共同的行為特性。再將所收集的木馬樣本藉由網絡可視化軟體來進行布局演算法，藉由布局後的網絡圖，可是更直覺地看出木馬病毒之間的共同性，並且進行重要Windows Api的篩選，最後再運用Weka來進行分類演算法，其結果與各家防毒公司進行比較。最後結果顯示本研究在未知木馬病毒上，偵測率高於各家防毒公司。

Trojan virus is the main cause of today''s cyber threats, through Trojan viruses lurking in the victim host, steal user information and endanger the user''s information security. Currently used by antivirus software feature library, although detect known viruses have a very high detection rate, but for unknown Trojan virus detection rate is very low. Therefore, this study proposed by Windows Api to detect viruses, Trojans by common between the behaviors. Then Trojan-samples visualization by network visualization software for layout algorithm, with a network diagram layout, but more intuitively see the commonality between the Trojan virus, and make important Windows Api screening, and finally use Weka to classify algorithms, and the results are compared with various antivirus companies. In this study, the final results show that the unknown Trojans, the detection rate in the various antivirus companies.

中文摘要 i
ABSTRACT ii
目錄 iii
表次 iv
圖次 v
一、 緒論 1
1.1 研究背景 1
1.2 研究動機與目的 2
1.3 論文架構 4
二、 相關技術與文獻探討 6
2.1 靜態分析與逆向工程 6
2.2 動態行為分析 7
2.3 Windows作業系統 8
2.3.1. Windows作業系統架構 9
2.3.2. Windows Api 10
2.4 網絡可視化(Visualizing Social Networks) 11
2.5 分類演算法(Classification) 16
2.5.1. 決策樹演算法 17
2.5.2. Weka介紹 18
2.6 相關研究 18
三、 研究方法 20
3.1 研究樣本 20
3.2 系統架構 26
3.2.1 惡意與善意樣本製作 26
3.2.2 數據樣本分析 30
3.2.3 分析資料格式製作 38
3.3 木馬特徵判斷方法 43
四、 實驗結果 48
五、 結論與未來發展 54
參考文獻 56

1.Alexander Gostev, Denis Maslennikov, Yury Namestnikov. (2011). Monthly Malware Statistics: October 2011. Retrieved Nov 20, 2012, from http://www.securelist.com/en/analysis/204792200/Monthly_Malware_Statistics_October_2011

2.Bastian, Mathieu, Heymann, Sebastien, &; Jacomy, Mathieu. (2009). Gephi: An Open Source Software for Exploring and Manipulating Networks.

3.Christodorescu, Mihai, &; Jha, Somesh. (2003). Static analysis of executables to detect malicious patterns. Paper presented at the Proceedings of the 12th conference on USENIX Security Symposium - Volume 12, Washington, DC.

4.Christodorescu, Mihai, Kinder, Johannes, Jha, Somesh, Katzenbeisser, Stefan, &; Veith, Helmut. (2005). Malware Normalization. Wisconsin, USA: University of Wisconsin, Madison.

5.Eades, Peter. (1984). A heuristic for graph drawing[J]. Congressus numerantium, 42, 149-160.

6.Freeman, Linton C. (2009). Visualizing Social Networks. Journal of Social, 1.

7.Global Research &; Analysis Team (GReAT), Kaspersky Lab. (2012). Monthly Malware Statistics: April 2012. Retrieved Nov 20, 2012, from http://www.securelist.com/en/analysis/204792228/Monthly_Malware_Statistics_April_2012

8.Hall, Mark, Frank, Eibe, Holmes, Geoffrey, Pfahringer, Bernhard, Reutemann, Peter, &; Witten, Ian H. (2009). The WEKA data mining software: an update. SIGKDD Explor. Newsl., 11(1), 10-18. doi: 10.1145/1656274.1656278

9.Hu, Yifan. (2010). Algorithms for Visualizing Large Networks.

10.Kirda, Engin, Kruegel, Christopher, Banks, Greg, Vigna, Giovanni, &; Kemmerer, Richard A. (2006). Behavior-based spyware detection. Paper presented at the Proceedings of the 15th conference on USENIX Security Symposium - Volume 15, Vancouver, B.C., Canada.

11.Namestnikov, Yury. (2012). IT Threat Evolution: Q3 2012. Retrieved Nov 20, 2012, from http://www.securelist.com/en/analysis/204792250/IT_Threat_Evolution_Q3_2012#12

12.Newsome, James. (2005). Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software.

13.Sugiyama K, Tagawa S, Toda M. (1981). Methods for visual understanding of hierarchical system structures. TEEE Transaction on Systems, 11(2), 109-125.

14.范文慶, 周彬彬, 安靖. (2010). 精通Windows API-函數、介面、程式設計實例.

15.苏璞睿, &; 杨轶. (2006). 基于可执行文件静态分析的入侵检测模型. 计算机学报, 29(9), 7.

16.楊峰, 李蔚. (2007). 信息可視化技術的分類研究. 圖書跟情報.

17.鄧瑋敦. (2010). 深入Windows核心-Windows Internals.