基于主机行为特征的恶意软件检测方法  

Malware detection by monitoring host's activities

作　　者：张永斌[1] 张艳宁[1] 

机构地区：[1]西北工业大学计算机学院,西安710129

出　　处：《计算机应用研究》2014年第2期547-550,554,共5页Application Research of Computers

基　　金：国家自然科学基金资助项目(60903126;60872145)

摘　　要：针对僵尸、远控木马等恶意软件检测问题,提出一种基于主机行为的异常检测模型。该模型通过持续性分析算法,判断主机与外部特定目标的通信行为是否具有周期性或连续性,提取出可疑的网络行为,并根据网络行为的触发、启动等异常检测规则对这些可疑的网络行为进行分析,判断主机是否感染恶意软件。实验结果表明,该模型可有效检测出感染恶意软件的主机,并具有很低误报率。To detect malware such as bot and trojan, this paper proposed a method based on inherent activities of compro- mised hosts. This method identified suspicious network traffic through persistent arithmetic that measured if hosts had temporal regularity when communicating with other hosts, and analyzed suspicious network traffic through rules of user driven activities and occurring moments to detect compromised hosts. The results show that the system can accurately detect compromised hosts with low error rates.

关 键 词：网络安全 恶意软件 僵尸网络 木马 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]