基于演化的漏洞检测框架  

Evolution-based vulnerability detection framework

作　　者：张林[1] 高岭[1] 汤声潮[2] 杨旸[2] 

机构地区：[1]西北大学信息科学与技术学院,西安710127 [2]四川省内江师范学院,四川内江641000

出　　处：《计算机应用研究》2009年第12期4724-4727,共4页Application Research of Computers

基　　金：国家科技支撑计划资助项目(2007BAH08B01);陕西省自然科学基金资助项目(2005f36)

摘　　要：为了解决目前主流的漏洞检测工具计算成本高、网络负载高、影响应用系统运行的问题,提出了基于演化的漏洞判定算法,基于演化的漏洞检测框架及其原型系统。该系统在传统的漏洞检测中引入计算机免疫理论,通过对计算机演化的监控来实现漏洞检测。该系统以订阅者/发布者分布式结构组织,订阅者负责收集其系统特征,发布者负责检测漏洞。实验测试结果表明,与其他的漏洞检测工具相比,其具备检测速度快,对网络运行影响小,对应用系统影响小的特点,适用于大规模计算网络。The high cost of computing and network resources brought by existing mainstream vulnerability detection tools affect the running of application systems seriously. To reduce the computing cost and waste of network resources, the algorithm, framework and prototype system of evolution-based vulnerability detection Was proposed here. The system improved the traditional vulnerability detection performance with introduction of computer immune theories, detected vulnerabilities by monitoring evaluation of computer systems. Components of the system were organized to comply with the subscriber/publisher architecture, the subscriber was responsible for system characteristics collection and the publisher was responsible for vulnerability detection. Experimental results demonstrate that compared with other vulnerability detection tools, the system is more efficiency, lower computing and network resources required ,less affection on applications and applicable to large-scale computing network.

关 键 词：漏洞 演化 攻击 订阅者/发布者 HTTP-RPC 

分 类 号：TP391[自动化与计算机技术—计算机应用技术] TP393.08[自动化与计算机技术—计算机科学与技术]