基于近邻关系特征的多态蠕虫防御方法  

Novel approach based on neighborhood relation signature against polymorphic internet worms

作　　者：汪洁[1] 王建新[1] 刘绪崇[2] 

机构地区：[1]中南大学信息科学与工程学院,湖南长沙410083 [2]湖南省公安厅网络安全保卫与技术侦察总队,湖南长沙410001

出　　处：《通信学报》2011年第8期150-158,共9页Journal on Communications

基　　金：国家重点基础研究发展计划("973"计划)基金资助项目(2008CB317107);国家教育部创新团队资助项目(IRT0661)~~

摘　　要：结合多态蠕虫的特点,着重考虑负载字节之间的关系,将蠕虫负载内部的近邻关系特征(NRS,neighbor-hood-relation signature)提取出来用于蠕虫检测。NRS建立在蠕虫负载内部相邻字节之间关系的基础上,体现了某些多态蠕虫各形态之间的共性特征,能够更灵活地对多态蠕虫进行检测。设计了NRSGA(NRS generating algorithm)算法来提取1-NRS、2-NRS和(1,2)-NRS,并分别进行了实验,以测试特征提取过程的正确性和NRS检测蠕虫的有效性。实验结果表明,与其他方法相比,NRS在检测多态蠕虫时具有更低的漏报率,能够更好地防御多态蠕虫的传播。A class of neighborhood-relation signatures（NRS） was proposed based on neighborhood relationship between worm bytes.Because NRS embodies common characteristics of different morph of some polymorphic worms,Different patterns of polymorphic worms efficiently were detected.NRS generating algorithm（NRSGA） was designed to generate three types of signatures： 1-NRS,2-NRS and（1,2）-NRS.Some experiments were performed to demonstrate the correct-ness of the process of signatures generation and the effectiveness of NRS.Experiment results show that our approach has lower false negative ratio in detecting worms,and is effective to prevent polymorphic worms from propagating.

关 键 词：信息安全 蠕虫特征 近邻关系特征 多态蠕虫 蠕虫检测 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]