基于漂移检测和集成学习的木马检测模型  

Trojan Detection Model Based on Drift Detection and Ensemble Learning

作　　者：李晔[1] 刘胜利[1] 张兆林[1] LI Ye;LIU Shengli;ZHANG Zhaolin(Information Engineering University,Zhengzhou 450001,China)

机构地区：[1]信息工程大学,河南郑州450001

出　　处：《信息工程大学学报》2017年第6期708-711,共4页Journal of Information Engineering University

基　　金：国家自然科学基金资助项目(61271252);郑州市科技创新团队资助项目(10CXTD150)

摘　　要：传统基于网络流量的木马检测方法对训练样本要求较高,泛化能力差,分类精度难以提升,且不能处理概念漂移问题。为提升现有方法的准确度,在研究网络流量通信特征的基础上,提出一种集成学习分类模型,在流量处理中检测其产生的概念漂移,根据检测结果动态更新由训练集构建的集成分类器,利用集成分类器加权集成,达到检测木马流量的目的。真实网络环境下的实验结果验证了该模型的有效性,通过重新训练和集成学习使漏报率和误报率显著降低。Traditional Trojan detection methods based on network flow overly depend on training sam- ples, have poor generalization ability and low classification precision, and are not able to deal with concept drift problem. To improve the accuracy of current methods, an ensemble learning classifica- tion model is proposed based on the research of the communication ieatures of network flow. The model made detection for concept drift in flow processing, and automatically replaced ensemble clas- sifiers built by training set according to detection result. And it weighted integration using ensemble classifiers to achieve the purpose of detecting Trojan flow. Experimental results verified the effective- ness of the model in the real network environment. By retraining and ensemble learning, the model can significantly reduce false negative rate and false positive rate.

关 键 词：木马检测 通信流量 概念漂移 集成学习 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]