Polymorphic蠕虫特征自动提取算法及检测技术研究  

Automatic signature generation algorithm and detection technology for Polymorphic worm

作　　者：赵旭[1] 何聚厚[1] 

机构地区：[1]陕西师范大学计算机科学学院,西安710062

出　　处：《计算机工程与应用》2008年第36期106-108,133,共4页Computer Engineering and Applications

基　　金：国家自然科学基金(No.60503008)~~

摘　　要：入侵检测系统检测蠕虫攻击的关键在于蠕虫特征是否准确,随着蠕虫Polymorphic技术的不断发展,如何快速有效地提取Polymorphic蠕虫特征,是入侵检测中特征提取领域的一个重要的研究方向。采用基于模式的特征提取算法,通过对多个可疑Polymorphic蠕虫流量进行序列比对,自动提取它们的最长公共子序列,结果用两种形式的向量表示;并采用相似度度量的检测方法,利用已提取的特征向量,判别新到来的Polymorphic蠕虫流量所属的类别,从误报率和漏报率方面验证了特征提取算法的有效性以及相似度度量检测方法的有效性。The crucial factor of the IDS （Intrusion Detection System） is whether the attack signature is accurate.With the unceasing development of the technology of polymorphic worm, how to generate the signature of polymorphic worm speedily and effectively is very important in the research area of the signature generation in IDS.This paper presents a signature generation algorithm based on pattern.The signature is the longest common subsequence generated by sequence comparison of several suspicious polymorphie worm flows,and represented in two vector styles.The new incoming polymorphic worm flows is detected by the signature vector and similarity metric.From the similarity metric in false positive and false negative,the experimental results show that this method can achieve high detection performance.

关 键 词：蠕虫 特征提取 相似度度量 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]