摘要： 通过分析多态Shellcode的行为特征，提出基于动态模拟的判决准则。以此准则为核心，针对现有方法的性能和应用性较差的问题，设计并实现了一个基于动态模拟的多态Shellcode检测系统，其模块采用多种优化技术以提高系统性能。使用3.3 GB实际网络数据和 11 000个多态Shellcode样本对原型系统进行实验，其虚警和漏警率均为0，提高了系统的吞吐量。
关键词:
多态Shellcode,
动态模拟,
入侵检测
Abstract: Based on the analysis of the characteristics of polymorphic Shellcode’s behavior, an dynamic emulation based detection criterion is proposed. Using the criterion, this paper designs and implements a dynamic emulation based polymorphic Shellcode detection system, which is highly optimized in each module. With 3.3 GB real network data and 11 000 polymorphic Shellcode samples, the experiment on prototype presents zero false positive and false negative, and it improves the throughput of system.
Key words:
polymorphic Shellcode,
dynamic emulation,
intrusion detection
中图分类号:
王兰佳;段海新;李 星. 基于动态模拟的多态Shellcode检测系统[J]. 计算机工程, 2008, 34(13): 7-9.
WANG Lan-jia; DUAN Hai-xin; LI Xing. Polymorphic Shellcode Detection System Based on Dynamic Emulation[J]. Computer Engineering, 2008, 34(13): 7-9.