恶意代码演化与溯源技术研究

Research on Malicious Code Evolution and Traceability Technology

恶意代码溯源是指通过分析恶意代码生成、传播的规律以及恶意代码之间衍生的关联性,基于目标恶意代码的特性实现对恶意代码源头的追踪.通过溯源可快速定位攻击来源或者攻击者,对攻击者产生一定的震慑打击作用,具有遏制黑客攻击、完善网络安全保障体系的重要作用和价值.近年来,网络安全形势愈加严峻,归类总结了学术界和产业界在恶意代码溯源领域的研究工作,首先揭示了恶意代码的编码特性以及演化特性,并分析这些特性与溯源的关系;然后,分别从学术界和产业界对恶意代码的溯源技术和研究进行梳理,同时对每个溯源阶段的作用以及影响程度进行了讨论,并对目前恶意代码的溯源对抗手段进行分析;最后讨论了恶意代码溯源技术面对的挑战和未来的发展趋势.

The traceability of malicious code refers to the tracking of the source of malicious code based on the characteristics of the target malicious code by analyzing the rules of the generation and propagation of malicious code and the correlation of derivation among malicious codes. The tracking technology can quickly locate the source of attacker or attacker, which would make a deterrent effect to the attacker. It has the important role and value in curbing deterring hacking attacks and improving the network security system. In recent years, the network security situation has become more and more severe. This study categorizes and summarizes research work in the academic and malicious code traceability field. First, the coding characteristics and evolutionary characteristics of malicious codes are revealled, and the relationship between these characteristics and traceability is analyzed. Then, the traceability techniques of malicious code are reviewed and the role and impact of each traceability phase are discussed in the industry and academia. Also analyzed is the level of confrontation of traceability of current malicious code. Finally, the challenges and the future development trend faced by malicious code tracing technology are discussed.