Research On The Key Technology Of Webpage Trojan Detection

With the rapid development of the Internet, the number of users to visit the Web site had been quickly growing. Network security problems in the Internet is more and more serious. Website Page Trojan has become a one of the greatest threats in the field of network security. it is very necessary to study and design a detection system of webpage Trojan with high detection rate and low false alarm rate.A DOM Trojan detection model based on Phoneyc Honeypot is proposed for detecting the highly obfuscated web Trojan. By using the technology consisted of static detection and dynamic detection we study the problem of false alarm rate on detecting the highly obfuscated web Trojan. The specific studied contents are listed as following.1. Studied and Summarized the theory of webpage Trojan, the technology of spreading Trojan and hidding Trojan, the technology of exploiting target with web browser vulnerabilities.2. Built the script execution environmeint of web links based on DOM model used to achieve the static feature detection.3. Analysed the hidden links and shellcode among the webpage Trojan in the exploiting process. By compared the data around the return-address of API and key instructions with date from feature Lib,we can identify the malicious shellcode.Experiment has shown that the trojan detection model could accurately detect many kinds of highly obfuscated Trojan and reduced false alarm rate.