毕业设计(论文)-LINUＸ下木马检测工具的研发.docVIP

LINUX下木马检测工具的研发 摘 要 近年来，“特洛伊木马”(以下简称木马)数量迅速增加，在各类非法程序中已经占到了极大的比重，由木马所造成的破坏和损失也越来越严重，因此，反木马的研究己成为网络安全领域的一个热点和重点。基于特征码的静态扫描技术由于具有检测潜伏的木马、病毒等非法程序的能力，成为反木马、反病毒等研究领域的一个热点，所以至今特征码技术得到了广泛的应用。特征代码法，是目前公认的检测己知病毒的最简单、开销最小的方法。检测工具在将已知木马以二进制读取到的4096位字符串，通过MD5取摘要作为特征码，然后将这些木马独有的特征搜集在一个木马特征码数据库中。每当需要确定文件是否为木马的时候，检测工具会以扫描的方式将数据文件与特征码数据库内的现有特征码一一比对，如果双方数据吻合，就可以判定该数据文件为木马文件。本工具检测准确，可识别病毒的名称，依据检测结果，可做相应的处理。 关键词：网络安全；木马；MD5；特征码 591论文网 www.591LW.com The Implementation of a Trojan Detection Tool Abstract In recent years, the number of trojan is increasing very rapid and it now amounts to the most part among in all the illegal programs. Trojans have brought much more serious damages and losses .As a result, the research of anti-trojan has already become the hotspot and the main emphasis in the area of network security. Because of its ability of detecting unknown trojans, signature-based scanning has currently turned into hotspot in the anti-trojan research area. So the characteristic code technology is used widely. The characteristic code technology is the method that has the simplest and lowest expense to check the Trojans. The tool gets 4,096 bits from the known Trojans file, and gets its message digest with MD5 algorithm, then puts this value in an INI file as the database of Trojan characteristic code. When a file is checked, the tool will scan the file and compare with the characteristic code database, if the message digest of this file is equal to a certain record, then we can determine the file is a Trojan file. The accuracy of our tool is very high, and can identify the name of the Trojan. According to the result, it can take corresponding measure to deal with the Trojan file. Key words：Network security; Trojan; MD5; Characteristic code 591论文网 www.591LW.com 目 录 论文总页数：26页 TOC \o 1-3 \h \z \u HYPERLINK \l _Toc173142707 1 引 言 PAGEREF _Toc173142707 \h 1 HYPERLINK \l _Toc173142708 1.1 木马