一种新型病毒主动防御技术与检测算法  

Novel virus active defense technique and detection algorithm

作　　者：陈顼颢[1] 王志英[1] 任江春[1] 郑重[1] 黄訸[1] 

机构地区：[1]国防科学技术大学计算机学院,长沙410073

出　　处：《计算机应用研究》2010年第6期2338-2340,共3页Application Research of Computers

摘　　要：在已有的病毒行为分析和模式识别技术的基础上,提出以用户行为模式为核心的主动防御策略,即识别用户的正常行为模式,在检测到异常行为时,判断出系统是否遭受到了恶意攻击。这种策略不依赖于恶意程序的繁衍和变迁,可以使防御技术不受制于恶意程序。对该防御策略进行了实现,并在虚拟执行环境下进行了实验,实验结果表明,该策略对未知病毒有较高的识别度。Based on virus behavior analysis and pattern recognition technology, this paper proposed an active defense strategy with user behavior patterns as the core, which could identify the user’s normal behavior, and could find that the system was attacked by malware when abnormal behavior was detected. This strategy was independent of the proliferation of malware which made defense technology not be subject to malicious programs. It implemented this defense strategy, and did experiments in a virtual execution environment. The results show that this strategy has a high rate in recognition of the unknown virus.

关 键 词：行为模式 主动防御 模式识别 虚拟执行 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]