蠕虫正则表达式特征自动提取技术研究  

Automatic generating regular expression signatures for real network worms

作　　者：唐勇[1] 诸葛建伟[2] 陈曙晖[1] 卢锡城[1] 

机构地区：[1]国防科技大学计算机学院,湖南长沙410073 [2]清华大学信息网络工程研究中心,北京100084

出　　处：《通信学报》2013年第3期141-147,共7页Journal on Communications

基　　金：国家高技术研究发展计划("863"计划)基金资助项目(2011AA01A103);国家自然科学基金资助项目(61003303;61003217)~~

摘　　要：提出一种实用的蠕虫正则表达式特征自动提取方法,该方法由蠕虫传播网络流样本获取、特征树生成、高假阳性特征剔除、特征融合这4步组成。该方法的优点是可输出具有强描述能力的包含".*"、".{k}"、"|"、"(c){k}"等元字符的正则表达式特征。基于蜜罐系统(Honeybow)实现了该方法,并针对互联网上数种真实蠕虫进行了实验。实验结果表明,该方法可以准确地提取真实蠕虫的正则表达式特征,可以在蜜罐、蠕虫及恶意代码分析等系统中应用。A practical worm regular expression of automatic extraction method was presented, which involves four steps： sample collection from worm propagation, signature tree generation, removal of high false-positive signatures, and signature merging. The advantage of this method is that it can directly output expression signature with the rich syntax of “＊”., “.{k}” , “1”, “（c）{k}”. Based on the honeypot system Honeybow deployed in Internet, the method was implemented and evaluated by several in-wild worms under real Internet environment. The experiment results show that the method can generate accurate regular expression signatures for real worms and is promising for the applications of automatic analysis of worms and malwares.

关 键 词：蠕虫 恶意代码 特征提取 特征树 正则表达式 蜜罐 入侵检测 

分 类 号：TP311.134.3[自动化与计算机技术—计算机软件与理论]