基于代碼分割的隱寫軟件識別技術研究
發(fā)布時間：2018-09-10 08:34
【摘要】：隱寫取證已經成為了當前計算機取證所面臨的嚴峻挑戰(zhàn)之一。在隱寫取證中,倘若取證者能夠識別出取證目標中的隱寫軟件,則將能避開當前隱寫取證所面臨的困難,為目標的發(fā)現(xiàn)和秘密信息的提取提供線索和依據(jù)。 本文在總結當前隱寫軟件識別及其相關的軟件特征技術研究現(xiàn)狀的基礎上,對隱寫取證的重要環(huán)節(jié)——隱寫軟件識別問題進行了較為深入的探討。具體工作如下: 1、從取證流程的角度,對原有隱寫取證步驟進行了擴展,將隱寫軟件識別問題納入隱寫取證過程之中,豐富了隱寫取證的手段,拓展了隱寫取證的內涵。 2、基于代碼分割的思想,提出了三種代碼分割方法,給出了一個基于代碼分割的隱寫軟件識別框架。該框架基于代碼分割能夠將一個復雜的程序(或軟件)分割成若干較易理解的代碼片段,降低了程序理解的復雜度。 3、提出了一種基于“指令詞”的隱寫軟件識別算法。該算法基于k-gram原理將程序指令操作碼序列近似分割成若干易于理解、具有獨立功能的代碼片段,構建“指令詞”;統(tǒng)計隱寫軟件中出現(xiàn)頻率較高的“指令詞”,構建基于“指令詞”的軟件特征向量,并用“指令詞”出現(xiàn)的頻數(shù)對特征向量量化;運用向量夾角余弦刻劃待識別軟件相對于目標隱寫軟件的匹配程度。實驗結果表明:該算法不僅能夠區(qū)分目標隱寫軟件與其他軟件,較為可靠地識別出經過代碼迷惑變換的隱寫軟件,而且可識別經過升級、捆綁的隱寫軟件“變種”,并區(qū)分不同的隱寫軟件。 4、提出了一種基于寄存器依賴的隱寫軟件識別算法。算法根據(jù)程序指令間的寄存器依賴關系,將程序的寄存器依賴圖分割成若干路徑,并將分割得到的各條路徑上的指令序列作為代碼模塊;運用待識別軟件與目標隱寫軟件的代碼模塊中的最大共有子序列的相對長度刻劃模塊間的匹配度,運用二分圖匹配的思想刻劃待識別軟件相對于目標隱寫軟件的匹配度。實驗結果表明:該算法對于隱寫軟件的變種能夠有效地識別。 最后,對全文工作進行了總結,對未來的研究進行了展望。
[Abstract]:Steganography has become one of the severe challenges of computer forensics. In steganography, if the forensics can identify the steganography software in the object of evidence, it will avoid the difficulties of steganography and provide clues and basis for the discovery of targets and the extraction of secret information. On the basis of summarizing the current research status of steganography software recognition and related software feature technology, this paper makes a deep discussion on steganography software recognition, which is an important link in steganography. The specific work is as follows: 1. From the point of view of evidence flow, the original steganography procedure is extended, and the steganography software identification is brought into the steganography process, which enriches the means of steganography. This paper extends the connotation of steganography. 2. Based on the idea of code segmentation, three methods of code segmentation are proposed, and a framework of steganography software recognition based on code segmentation is presented. Based on code segmentation, the framework can break a complex program (or software) into more understandable pieces of code. The complexity of program understanding is reduced. 3. A steganography software recognition algorithm based on instruction word is proposed. Based on the principle of k-gram, the algorithm approximately divides the sequence of program instruction opcodes into several easy to understand code fragments with independent function, and constructs "instruction words", which appear frequently in statistical steganography software. The software feature vector based on "instruction word" is constructed, and the frequency pair feature vector quantization of "instruction word" is used, and the matching degree of the software to be identified relative to the target steganography software is characterized by vector angle cosine. The experimental results show that the algorithm can not only distinguish the target steganography software from other software, but also identify the "variant" of the upgraded and bundled steganography software. Finally, a register-based steganography software recognition algorithm is proposed. According to the register dependence relation between program instructions, the register dependency graph of the program is divided into several paths, and the sequence of instructions on each path is taken as the code module. The matching degree of the module is described by using the relative length of the maximum common subsequence in the code module of the steganography software and the matching degree of the target steganography software is described by the idea of bipartite graph matching. Experimental results show that the algorithm can effectively identify the steganography software variants. Finally, the paper summarizes the work of the paper and looks forward to the future research.
【學位授予單位】：解放軍信息工程大學
【學位級別】：碩士
【學位授予年份】：2011
【分類號】：TP311.5;D918.2
本文編號：2233929
[Abstract]:Steganography has become one of the severe challenges of computer forensics. In steganography, if the forensics can identify the steganography software in the object of evidence, it will avoid the difficulties of steganography and provide clues and basis for the discovery of targets and the extraction of secret information. On the basis of summarizing the current research status of steganography software recognition and related software feature technology, this paper makes a deep discussion on steganography software recognition, which is an important link in steganography. The specific work is as follows: 1. From the point of view of evidence flow, the original steganography procedure is extended, and the steganography software identification is brought into the steganography process, which enriches the means of steganography. This paper extends the connotation of steganography. 2. Based on the idea of code segmentation, three methods of code segmentation are proposed, and a framework of steganography software recognition based on code segmentation is presented. Based on code segmentation, the framework can break a complex program (or software) into more understandable pieces of code. The complexity of program understanding is reduced. 3. A steganography software recognition algorithm based on instruction word is proposed. Based on the principle of k-gram, the algorithm approximately divides the sequence of program instruction opcodes into several easy to understand code fragments with independent function, and constructs "instruction words", which appear frequently in statistical steganography software. The software feature vector based on "instruction word" is constructed, and the frequency pair feature vector quantization of "instruction word" is used, and the matching degree of the software to be identified relative to the target steganography software is characterized by vector angle cosine. The experimental results show that the algorithm can not only distinguish the target steganography software from other software, but also identify the "variant" of the upgraded and bundled steganography software. Finally, a register-based steganography software recognition algorithm is proposed. According to the register dependence relation between program instructions, the register dependency graph of the program is divided into several paths, and the sequence of instructions on each path is taken as the code module. The matching degree of the module is described by using the relative length of the maximum common subsequence in the code module of the steganography software and the matching degree of the target steganography software is described by the idea of bipartite graph matching. Experimental results show that the algorithm can effectively identify the steganography software variants. Finally, the paper summarizes the work of the paper and looks forward to the future research.
【學位授予單位】：解放軍信息工程大學
【學位級別】：碩士
【學位授予年份】：2011
【分類號】：TP311.5;D918.2
【參考文獻】
相關期刊論文 前3條
1 姜楠;王健;楊義先;;新的唯秘密載體信息隱藏分析方法[J];北京郵電大學學報;2006年02期
2 武嘉;張茹;鈕心忻;楊義先;;針對BPCS隱寫的隱寫分析法[J];北京郵電大學學報;2009年04期
3 羅向陽;劉粉林;楊春芳;王道順;;基于最優(yōu)小波包分解的圖像隱寫通用檢測[J];中國科學:信息科學;2010年02期
相關碩士學位論文 前3條
1 陳林;基于指令詞的軟件特征技術研究[D];解放軍信息工程大學;2010年
2 方霞;代碼逆向分析中的語句恢復與算法識別技術研究[D];解放軍信息工程大學;2009年
3 鞏道福;基于Java的軟件水印及其相關技術研究[D];解放軍信息工程大學;2009年
，本文編號：2233929
本文鏈接：http://sikaile.net/shekelunwen/gongan/2233929.html
