木馬檢測工具的實現

論文字數:13358,頁數:30

摘  要
近年來，“特洛伊木馬”(以下簡稱木馬)數量迅速增加，在各類非法程序中已經占到了極大的比重，由木馬所造成的破壞和損失也越來越嚴重，因此，反木馬的研究己成為網絡安全領域的一個熱點和重點。基于特征碼的靜態掃描技術由于具有檢測潛伏的木馬、病毒等非法程序的能力，成為反木馬、反病毒等研究領域的一個熱點，所以至今特征碼技術得到了廣泛的應用。特征代碼法，是目前公認的檢測己知病毒的最簡單、開銷最小的方法。檢測工具在將已知木馬以二進制讀取到的4096位字符串，通過MD5取摘要作為特征碼，然后將這些木馬獨有的特征搜集在一個木馬特征碼數據庫中。每當需要確定文件是否為木馬的時候，檢測工具會以掃描的方式將數據文件與特征碼數據庫內的現有特征碼一一比對，如果雙方數據吻合，就可以判定該數據文件為木馬文件。本工具檢測準確，可識別病毒的名稱，依據檢測結果，可做相應的處理。

關鍵詞：網絡安全；木馬；MD5；特征碼

The Implementation of a Trojan Detection Tool
Abstract
In recent years, the number of trojan is increasing very rapid and it now amounts to the most part among in all the illegal programs. Trojans have brought much more serious damages and losses .As a result, the research of anti-trojan has already become the hotspot and the main emphasis in the area of network security. Because of its ability of detecting unknown trojans, signature-based scanning has currently turned into hotspot in the anti-trojan research area. So the characteristic code technology is used widely. The characteristic code technology is the method that has the simplest and lowest expense to check the Trojans. The tool gets 4,096 bits from the known Trojans file, and gets its message digest with MD5 algorithm, then puts this value in an INI file as the database of Trojan characteristic code. When a file is checked, the tool will scan the file and compare with the characteristic code database, if the message digest of this file is equal to a certain record, then we can determine the file is a Trojan file. The accuracy of our tool is very high, and can identify the name of the Trojan. According to the result, it can take corresponding measure to deal with the Trojan file.

Key words：Network security; Trojan; MD5; Characteristic code

目  錄

1 引 言 1
1.1 木馬查殺工具設計背景 1
1.1.1 木馬的概念及技術原理 1
1.1.2 木馬的危害 3
1.2 現在流行的查殺方式 3
1.3 木馬檢測的實現方法 6
1.3.1 PE文件靜態信息的提取和特征碼的設置 6
1.3.2 特征碼選擇與采集 8
1.3.3 特征碼庫的設計 8
1.3.4 信息摘要技術中的MD5算法 9
1.3.5 MD5算法的原理及應用 10
1.3.6 MD5作特征碼簡介 11
2 需求分析及方案設計 11
2.1 本工具要完成的功能 11
2.2 環境需求 11
2.3 可行性研究 11
3 木馬查殺功能的實現 12
3.1 工具模塊介紹 12
3.2 木馬特征碼的讀取 12
3.3 獲得文件MD5特征碼 14
3.4 文件屬性的更改 19
3.5 實現驅動器的選擇 19
3.6 MD5特征碼查殺 22
結    論 23
參考文獻 24
致    謝 25
聲    明 26