基于概念漂移检测的数据流木马检测模型  

Trojan Detection Model Based on Concept Drift Detection in Data Flow

作　　者：李晔[1] 颜峻[1] 刘胜利[1] 张兆林[1] 

机构地区：[1]信息工程大学,河南郑州450001

出　　处：《信息工程大学学报》2017年第3期354-358,共5页Journal of Information Engineering University

基　　金：国家自然科学基金资助项目(61271252);郑州市科技创新团队资助项目(10CXTD150)

摘　　要：网络数据流复杂多样且存在概念漂移,导致基于通信行为的木马检测方法部署在实际网络环境中会出现漏报和误报。为了提升现有木马检测方法的准确度,研究了常见木马的网络通信行为,分析了数据流所产生的概念漂移问题,在此基础之上提出了一种基于数据流概念漂移检测的木马检测模型,在数据流处理中对其产生的概念漂移进行检测,根据检测结果动态更新分类模型。真实网络环境下的实验结果验证了该模型的有效性,通过检测数据流中的概念漂移,提高了基于数据流的木马检测方法的准确性和实用性。Network data flow is complex and diverse and there is hidden concept drift. Accordingly, Trojan detection methods based on communication behavior have false negatives and false positives when deployed in the real network environment. To improve the accuracy of current Trojan detection methods, this paper studied the network communication behavior of Trojans and analyzed the con- cept drift of data flow, and then proposed a Trojan detection model based on concept drift detection in data flow. The model implemented detection for concept drift in data flow processing, and automatically replaced classification model according to detection result. Experimental results verified the effectiveness of the model in the real network environment. By detecting the concept drift of data flow, it improves the accuracy and practicality for Trojan detection methods based on data flow.

关 键 词：木马检测 通信行为 数据流 概念漂移 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]