| 基于NLA的Polymorphic蠕虫特征自动提取算法研究 |
| |
| 引用本文： | 赵旭,何聚厚.基于NLA的Polymorphic蠕虫特征自动提取算法研究[J].计算机工程与应用,2012,48(8):122-124,130. |
| |
| 作者姓名： | 赵旭 何聚厚 |
| |
| 作者单位： | 1. 陕西师范大学图书馆,西安,710062
2. 陕西师范大学计算机科学学院,西安,710062 |
| |
| 基金项目： | 国家自然科学基金（No.60503008）. |
| |
| 摘 要： | 随着Polymorphic蠕虫变形技术的不断发展,如何快速有效地提取其特征是入侵检测中特征提取领域的一个重要研究方向。采用基于模式的特征提取算法NLA(Normalized Local Alignment),通过对多个可疑Polymorphic蠕虫流量进行序列比对,自动提取高相似度公共子序列,以向量的形式构造蠕虫特征。实验结果表明该算法在误报率和漏报率方面均优于传统算法。
|
| 关 键 词： | 蠕虫 特征提取 规格化局部比对(NLA) 相似度度量 |
ZHAO Xu, HE Juhou. Automatic signature generation research for Polymorphic worm based on NLA algorithm. Computer En- gineering and Applications, 2012, 48（8） ：122-124. |
| |
| ZHAO Xu
,
HE Juhou.ZHAO Xu, HE Juhou. Automatic signature generation research for Polymorphic worm based on NLA algorithm. Computer En- gineering and Applications, 2012, 48（8） ：122-124.[J].Computer Engineering and Applications,2012,48(8):122-124,130. |
| |
| Authors: | ZHAO Xu HE Juhou |
| |
| Affiliation: | 1.Library, Shaanxi Normal University, Xi＇an 710062, China 2.School of Computer Science, Shaanxi Normal University, Xi＇ an 710062, China |
| |
| Abstract: | With the unceasing development of the technology of Polymorphic worm, how to generate the signature of Polymorphic worm speedily and effectively is very important in the research area of the signature generation in IDS. This paper presents an automat- ic signature generation algorithm based on normalized local alignment algorithm. The highest similarity common subsequence is gener- ated by sequence comparison of several suspicious Polymorphic worm flows. And the signature is presented by subsequence vector. The experimental results show this algorithm is effective than traditional method in false oositive and false negative. |
| |
| Keywords: | worm signature generation normalized local alignment similarity metric |
| 本文献已被 CNKI 维普 万方数据 等数据库收录！ |
|
