僵尸网络指纹特征自动提取技术  

Research of Automatically Generating Signatures for Botnets

作　　者：王新良[1,2] 刘芳[1] 马婧[1] 雷振明[1] 

机构地区：[1]北京邮电大学信息与通信工程学院,北京100876 [2]河南理工大学电气工程与自动化学院,河南焦作454100

出　　处：《北京邮电大学学报》2011年第4期109-112,共4页Journal of Beijing University of Posts and Telecommunications

基　　金：国家自然科学基金项目(61072061)

摘　　要：为了能够快速掌握指纹特征并及时准确检测新型僵尸网络,对指纹特征提取算法进行了研究.在已有算法的基础上依据僵尸网络指纹特征分布的特点,提出了适用于该指纹特征自动提取的算法及系统设计框架,使其能够自适应地对不同功能的数据流分别进行指纹特征提取.实验结果表明,改进后算法获取的有效指纹特征数要远远优于改进前算法提取的有效特征数,从而能够更好地检测僵尸网络的众多变种.In order to attain the signature characteristics rapidly and detect unknown botnets precisely, an automated extracting signatures algorithm and a system designing framework are presented according to the distribution of the botnet signature characteristics, they can self-adaptively extract the signature characteristics on data flows of different functions. Experiment shows that the improved algorithm acquires far more effective signatures than before and so it can detect the numerous variants of the botnet efficiently.

关 键 词：僵尸网络 指纹特征提取 聚类 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]