基于序列比对的攻击特征自动提取方法  

Automatic Generation of Attack Signatures Based on Sequence Alignment

作　　者：秦拯[1] 尹毅[1] 陈飞杨[2] 陈薇娜[1] 董锐[1] 王泽平[1] 

机构地区：[1]湖南大学软件学院,湖南长沙410082 [2]国防科学技术大学计算机学院,湖南长沙410074

出　　处：《湖南大学学报（自然科学版）》2008年第6期77-81,共5页Journal of Hunan University:Natural Sciences

基　　金：国防科工委基础科研“十一五”规划项目(20061143269);湖南省科技计划项目(2006FJ4110);广东省科技计划项目(0711020400157,2007B01020004);东莞市科技计划项目(2006D058,2007108101021)

摘　　要：在对生物信息学序列比对理论研究的基础上,将序列比对算法应用到入侵检测模型中,提出一种序列比对攻击特征自动提取新方法.针对Needleman-Wusch算法缺乏攻击知识积累,设计一种基于知识积累的序列比对算法IASA(Information Accumulation Sequence Alignment).新方法首先调整数据去噪并进行数据聚类,使用IASA进行序列比对,使得序列比对的特征片段趋向于更合理结果,再将比对结果所代表的攻击特征转化为IDS规则.实验结果表明,该方法能提高攻击特征生成质量,降低系统误报率.Based on in-depth research on bioinformatics sequence alignment, the sequence alignment algorithm was used in intrusion detection model, and then an attack signature automatic-generation approach, which applied sequence alignment, was presented. Because the Needleman-Wusch approach was short of information accumulation of attack, the IASA（Information Accumulation Sequence Alignment）algorithm was designed. First of all, it modulated, denoised and clustered data. Secondly, the sequences were aligned by using the IASA algorithm. As a result, signature segment of sequence alignment was more rational. Finally, attack signatures that were represented by alignment results were converted into IDS rules. Our experiment has proved that this approach is better for the improvement of the quality of generating attack signatures and can reduce false positive rate.

关 键 词：入侵检测 攻击特征提取 序列比对 知识积累 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]