基于网络的恶意代码检测技术

通过对传统分布式IDS的分析，指出基于详细协议分析的多引擎小规则集的系统结构用于网络级恶意代码检测的缺陷，设计了单引擎大特征集的网络级恶意代码检测模型及恶意代码特征描述语言；分析了网络数据流的特征，通过对特征串进行优化的方法，避免特征串后缀与数据流的频繁碰撞及链表分支不平衡的问题，大幅度提高了WM算法检测网络恶意代码的效率。

Network-based malcode detection technology

Following the analysis for traditional distributed IDS, disadvantages that applying structure of multiple engine and small rules set to detect network-level malcode were pointed out, which is based on detailed protocol decoding. Detection model and anti-malcode markup language of network-level malcode were designed for single engine and big rules set. The characteristics of network data flow were analyzed. By optimization of patterns, frequent collisions between suffix with data flow and unbalanced branched of chained list were avoided. The efficiency by using WM algorithm to detect malcode on network level can be remarkably increased.