基于NLA的Polymorphic蠕虫特征自动提取算法研究  

Automatic signature generation research for Polymorphic worm based on NLA algorithm

作　　者：赵旭[1] 何聚厚[2] 

机构地区：[1]陕西师范大学图书馆,西安710062 [2]陕西师范大学计算机科学学院,西安710062

出　　处：《计算机工程与应用》2012年第8期122-124,130,共4页Computer Engineering and Applications

基　　金：国家自然科学基金(No.60503008)

摘　　要：随着Polymorphic蠕虫变形技术的不断发展,如何快速有效地提取其特征是入侵检测中特征提取领域的一个重要研究方向。采用基于模式的特征提取算法NLA(Normalized Local Alignment),通过对多个可疑Polymorphic蠕虫流量进行序列比对,自动提取高相似度公共子序列,以向量的形式构造蠕虫特征。实验结果表明该算法在误报率和漏报率方面均优于传统算法。With the unceasing development of the technology of Polymorphic worm, how to generate the signature of Polymorphic worm speedily and effectively is very important in the research area of the signature generation in IDS. This paper presents an automat- ic signature generation algorithm based on normalized local alignment algorithm. The highest similarity common subsequence is gener- ated by sequence comparison of several suspicious Polymorphic worm flows. And the signature is presented by subsequence vector. The experimental results show this algorithm is effective than traditional method in false oositive and false negative.

关 键 词：蠕虫 特征提取 规格化局部比对(NLA) 相似度度量 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]