基于通信特征分析的蠕虫检测和特征提取方法的研究  

Worm detection and signature extraction based on communication characteristics

作　　者：辛毅[1] 方滨兴[1] 贺龙涛[2] 云晓春[2] 李志东[1] 

机构地区：[1]哈尔滨工业大学计算机网络与信息安全技术研究中心,黑龙江哈尔滨150001 [2]国家计算机网络应急技术处理协调中心,北京100029

出　　处：《通信学报》2007年第12期1-7,共7页Journal on Communications

基　　金：国家自然科学基金资助项目(60403033)~~

摘　　要：提出了一种基于通信特征分析的蠕虫检测与特征提取技术,在解析蠕虫传播过程中特有的通信模式的基础上,评估通信特征集合间的相似度,通过检测传染性来检测蠕虫,这种方法具有更高的检测精度、通用性和适应性。在此基础上设计了启发式检测体系结构,利用盲目跟踪、意向跟踪和锁定跟踪从通信协议、通信序列和通信内容3个层次逐级排除非蠕虫通信,筛选出蠕虫报文组,提取出蠕虫特征码。这种技术大幅缩减了采集量和分析量,能在高强度背景噪声的干扰快速检测蠕虫并提取出相应的特征。Worm detection and signature extraction was presented based on analysis of similar communication characteristics, which identifies the distinct communication pattern of worm spread, and evaluates the similarity metric of communication characteristic sets, and detects worms by detecting their infectivity with higher detection precision, generality and adaptability. Based on this, a heuristic detection framework is designed, which eliminates non-worm traffic from protocol, sequence, and content in three levels via blind, intent and lock track, then filters out worm packets and extracts signatures. The technique reduces data collection volume and analysis cost dramatically, and can detection worm and extract signature quickly in the environment with high strength background noise.

关 键 词：蠕虫 通信特征 检测 特征提取 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]