Research And Implementation Of Iis Webpage Trojan Detection System Based On Dom Model

With the evolution of Internet technology, the network has been the most important way access to information and convenient service in people’s daily lives. The increasing rich websites attract a large number of users, but at the same time, the types of Trojans in the network are also increasing, which has brought a great impact to the security vendors. While the Internet technology improved so much, the Internet security technology didn’t get the same attention and acquired rare achievement, which has slowed down the entire Internet technology development process. In recent years, Webpage Trojan is one of the main ways to spread Trojans in the network. In order to prevent Trojans from root causes, it’s necessary to guarantee the security of the web server. The topic is aimed to solve the Trojan problem in IIS web server, and try to put forward a Trojan detection model that used to detect Webpage Trojan in IIS server by scanning the web page.Firstly, this paper introduces the most popular classifications of the IIS Webpage Trojan as well as their theory of attack web server. And do some research to analysis the technology used by IIS Webpage Trojan, includes the documentation object model of a web page and the interpreter of JS script language. Secondly, compare between some most used Trojan detection algorithms, then determine to use which algorithm as the intelligent detection algorithm in this paper. At the same time, due to vagueness of Trojan behavior, we try to introduce and use fuzzy classification theory to optimize the detection algorithm. After carefully, analyze the behavioral characteristics of IIS Webpage Trojan, we divide the behavioral characteristics into two parts:external behavior characteristics and internal characteristics. Thirdly, propose the design of web-based behavior analysis of vector space model to deal with abstract web page information and collect the structured information of web page. Then we design and implement behavior-based IIS Webpage Trojan detector with this vector space model.Finally, construct a series of positive and negative web page sample data set, to simulate data training for this detection model. Then through a series of test data, to make a contrast with other professional anti-virus software on model’s detection rate, false negative rate and false rate analysis, to prove the accuracy of the issues raised in the IIS Web Trojan detection model.