| Polymorphic蠕虫特征自动提取算法及检测技术研究 |
| |
| 引用本文： | 赵旭,何聚厚.Polymorphic蠕虫特征自动提取算法及检测技术研究[J].计算机工程与应用,2008,44(36):106-108. |
| |
| 作者姓名： | 赵旭 何聚厚 |
| |
| 作者单位： | 陕西师范大学,计算机科学学院,西安,710062 |
| |
| 基金项目： | 国家自然科学基金
|
| |
| 摘 要： | 入侵检测系统检测蠕虫攻击的关键在于蠕虫特征是否准确,随着蠕虫Polymorphic技术的不断发展,如何快速有效地提取Polymorphic蠕虫特征,是入侵检测中特征提取领域的一个重要的研究方向。采用基于模式的特征提取算法,通过对多个可疑Polymorphic蠕虫流量进行序列比对,自动提取它们的最长公共子序列,结果用两种形式的向量表示;并采用相似度度量的检测方法,利用已提取的特征向量,判别新到来的Polymorphic蠕虫流量所属的类别,从误报率和漏报率方面验证了特征提取算法的有效性以及相似度度量检测方法的有效性。
|
| 关 键 词： | 蠕虫 特征提取 相似度度量 |
| 收稿时间： | 2008-7-24 |
| 修稿时间： | 2008-10-17
|
Automatic signature generation algorithm and detection technology for Polymorphic worm |
| |
| ZHAO Xu,HE Ju-hou.Automatic signature generation algorithm and detection technology for Polymorphic worm[J].Computer Engineering and Applications,2008,44(36):106-108. |
| |
| Authors: | ZHAO Xu HE Ju-hou |
| |
| Affiliation: | Department of Computer Science，Shaanxi Normal University，Xi’an 710062，China |
| |
| Abstract: | The crucial factor of the IDS(Intrusion Detection System) is whether the attack signature is accurate.With the un- ceasing development of the technology of polymorphic worm,how to generate the signature of polymorphic worm speedily and effectively is very important in the research area of the signature generation in IDS.This paper presents a signature generation algorithm based on pattern.The signature is the longest common subsequence generated by sequence comparison of several suspi- cious polymorphic worm flows,and represented in two vector styles.The new incoming polymorphic worm flows is detected by the signature vector and similarity metric.From the similarity metric in false positive and false negative,the experimental results show that this method can achieve high detection performance. |
| |
| Keywords: | worm signature generation similarity metric |
| 本文献已被 CNKI 万方数据 等数据库收录！ |
| 点击此处可从《计算机工程与应用》浏览原始摘要信息 |
|
点击此处可从《计算机工程与应用》下载全文 |
|
