基于HoneyClient蜜罐的挂马检测

针对当前互联网客户端攻击频发的态势,首先阐述了基于本地程序漏洞的客户端攻击概念,着重讲解了网站挂马攻击的特征。其次阐明了客户端蜜罐系统的基本原理,并介绍了一种高效的客户端蜜罐系统HoneyClient。随后通过对网站挂马攻击的特征分析提出了使用HoneyClient对其进行有效检测的方案,并对该方案进行了事实验证。最后通过对实验结果的分析与总结,提出了对网页木马型客户端攻击进行检测的改进策略和展望。

Detection of Web-site with Trojan Based on HoneyClient

As client-side attacks occur frequently on the Internet,this article describes the concept of client-side attacks based on local-program vulnerabilities,and focuses on the characteristics of Web Trojan attacks. Then it,clarifi es the basic principles of the client-side honeypot system,and gives an effi cient client-side honeypot system HoneyClient. Then in the light of characteristic analysis on Web Trijan,it presents an effective Web Trojan detection scheme based on HoneyClient. The effi ciency of this sch...