毕业设计论文-木马检测工具的实现(含源程序代码).doc

源程序代码等全套设计联系QQ 695132052 各专业都有
分类号: U D C:D10621-408-(2007) 5864-0
密级:公开编号:2003031311
成都信息工程学院
学位论文
木马检测工具的实现
论文作者姓名:
魏云柯
申请学位专业:
计算机科学与技术
申请学位类别:
工学学士
指导教师姓名(职称):
熊淑华(副教授)
论文提交日期:
2007年6月9日
木马检测工具的实现
摘要
近年来,“特洛伊木马”(以下简称木马)数量迅速增加,在各类非法程序中已经占到了极大的比重,由木马所造成的破坏和损失也越来越严重,因此,反木马的研究己成为网络安全领域的一个热点和重点。基于特征码的静态扫描技术由于具有检测潜伏的木马、病毒等非法程序的能力,成为反木马、反病毒等研究领域的一个热点,所以至今特征码技术得到了广泛的应用。特征代码法,是目前公认的检测己知病毒的最简单、开销最小的方法。检测工具在将已知木马以二进制读取到的4096位字符串,通过MD5取摘要作为特征码,然后将这些木马独有的特征搜集在一个木马特征码数据库中。每当需要确定文件是否为木马的时候,检测工具会以扫描的方式将数据文件与特征码数据库内的现有特征码一一比对,如果双方数据吻合,就可以判定该数据文件为木马文件。本工具检测准确,可识别病毒的名称,依据检测结果,可做相应的处理。
关键词:网络安全;木马;MD5;特征码
The Implementation of a Trojan Detection Tool
Abstract
In recent years, the number of trojan is increasing very rapid and it now amounts to the most part among in all the illegal programs. Trojans have brought much more serious damages and losses .As a result, the research of anti-trojan has already e the hotspot and the main emphasis in the area work security. Because of its ability of detecting unknown trojans, signature-based scanning has currently turned into hotspot in the anti-trojan research area. So the characteristic code technology is used widely. The characteristic code technology is the method that has the simplest and lowest expense to check the Trojans. The tool gets 4,096 bits from the known Trojans file, and gets its message digest with MD5 algorithm, then puts this value in an INI file as the database of Trojan characteristic code. When a file is checked, the tool will scan the file pare with the characteristic code database, if the message digest of this file is equal to a certain record, then we can determine the file is a Trojan file. The accuracy of our tool is very high, and can identify the name of the Trojan. According to the result, it can take corresponding measure to deal with the Trojan file.
Key work security; Trojan; MD5; Characteristic code
目录
论文总页数:26页
1 引言 1
木马查杀工具设计背景 1
木马的概念及技术原理 1
木马的危害 3