基于事件序列的蠕虫网络行为分析算法  

Analysis algorithm for the worm network behavior based on event sequence

作　　者：张甲[1] 段海新[1] 葛连升[2] 

机构地区：[1]清华大学网络中心,北京100084 [2]山东大学网络中心,山东济南250100

出　　处：《山东大学学报（理学版）》2007年第9期36-40,45,共6页Journal of Shandong University(Natural Science)

基　　金：国家242信息安全计划资助项目(2006A30)

摘　　要：蠕虫以及其他一些恶意代码的更新速度越来越快,如何快速有效地分析大量恶意样本成为网络安全研究的一个问题.因此提出了一种基于事件序列的蠕虫网络行为自动分析算法.该算法依靠在实验环境中采集的纯净恶意流量,通过使用数据流的压缩归并等方法获取网络行为的基本轮廓以及网络特征码.该算法的使用可以加快蠕虫等恶意代码的分析速度,提高防火墙以及网络入侵检测系统的配置效率.As the updating speed of the worm and other malicious codes grows faster and faster, how to analyze large sum of malicious sample quickly and effectively becomes an issue of research on internet security. Therefore, an analysis algorithm for worm network behavior based on event sequence was proposed. This algorithm uses the data flow recombination and compression methods to process the pure malicious data. With this procedure, it can get the network behavior profile and the signature of the worm. 3＇he application of this algorithm will greatly improve the efficiency of analyzing the worm network behavior, which will be significant for the deployment of firewalls and network invasion detection systems.

关 键 词：网络安全 网络行为 蠕虫检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]