毕业设计（论文）-LINUX下木马检测工具的研发.doc

LINUX下木马检测工具的研发 摘 要 近年来，“特洛伊木马”(以下简称木马)数量迅速增加，在各类非法程序中已经占到了极大的比重，由木马所造成的破坏和损失也越来越严重，因此，反木马的研究己成为网络安全领域的一个热点和重点。基于特征码的静态扫描技术由于具有检测潜伏的木马、病毒等非法程序的能力，成为反木马、反病毒等研究领域的一个热点，所以至今特征码技术得到了广泛的应用。特征代码法，是目前公认的检测己知病毒的最简单、开销最小的方法。检测工具在将已知木马以二进制读取到的4096位字符串，通过MD5取摘要作为特征码，然后将这些木马独有的特征搜集在一个木马特征码数据库中。每当需要确定文件是否为木马的时候，检测工具会以扫描的方式将数据文件与特征码数据库内的现有特征码一一比对，如果双方数据吻合，就可以判定该数据文件为木马文件。本工具检测准确，可识别病毒的名称，依据检测结果，可做相应的处理。 关键词：网络安全；木马；MD5；特征码 The Implementation of a Trojan Detection Tool Abstract In recent years, the number of trojan is increasing very rapid and it now amounts to the most part among in all the illegal programs. Trojans have brought much more serious damages and losses .As a result, the research of anti-trojan has already become the hotspot and the main emphasis in the area of network security. Because of its ability of detecting unknown trojans, signature-based scanning has currently turned into hotspot in the anti-trojan research area. So the characteristic code technology is used widely. The characteristic code technology is the method that has the simplest and lowest expense to check the Trojans. The tool gets 4,096 bits from the known Trojans file, and gets its message digest with MD5 algorithm, then puts this value in an INI file as the database of Trojan characteristic code. When a file is checked, the tool will scan the file and compare with the characteristic code database, if the message digest of this file is equal to a certain record, then we can determine the file is a Trojan file. The accuracy of our tool is very high, and can identify the name of the Trojan. According to the result, it can take corresponding measure to deal with the Trojan file. Key words：etwork security; Trojan; MD5; Characteristic code目 录 论文总页数：26页 1 引 言 1 1.1 木马查杀工具设计背景 1 1.1.1 木马的概念及技术原理 1 1.1.2 木马的危害 3 1.2 现在流行的查杀方式 3 1.3 木马检测的实现方法 6 1.3.1 PE文件静态信息的提取和特征码的设置 6 1.3.2 特征码选择与采集 8 1.3.3 特征码库的设计 8 1.3.4 信息摘要技术中的MD5算法 9 1.3.5 MD5算法的原理及应用 10 1.3.6 MD5作特征码简介 11 2 需求分析及方案设计 11 2.1 本工具要完成的功能 11 2.2 环境需求