基于贝叶斯分类算法的木马程序流量识别方法  

Traffic Identifying Method for Trojan Detection upon Bayesian Classification Algorithm

作　　者：张鑫[1] 马勇[1] 曹鹏[1] 

机构地区：[1]国家计算机病毒应急处理中心,天津300457

出　　处：《信息网络安全》2012年第8期115-117,共3页Netinfo Security

摘　　要：针对传统计算机杀毒产品对木马程序识别问题上存在的资源消耗和杀毒滞后问题,结合网络流量的分类算法提取各种应用服务流量的特征属性,文章采用朴素贝叶斯分类算法对网络中木马程序流量进行识别。这种方法可以在一定程度上解决现有计算机杀毒产品资源消耗和杀毒滞后的问题。实验结果表明,对于网络中处在待机状态下的木马程序产生的数据流识别效果明显,只需较少量的训练样本即可获得较高的识别率。In view of the traditional computer antivirus products on Trojan program identification have some problems of resource consumption and antivirus lag, combining network flow classification algorithm to extract various kinds of application service flow features, using Naive Bayesian classification algorithm on network traffic to identificate Trojans program. Using this method can to reduse some problems of computer antivirus products resource consumption and antivirus lag. The experimental results show that, the identification effect of Trojan program traffic in standby state is very obvious, using only a small amount of training samples to get a higher recognition rate.

关 键 词：木马程序 朴素贝叶斯分类算法 网络流量 识别 

分 类 号：O212.8[理学—概率论与数理统计] TP393.08[理学—数学]