邮件病毒行为自动分析与特征库生成技术研究  

Research on Automatic Analysis of Email Virus Behavior and Feature Library Generation Technology

作　　者：吉小鹏[1] JI Xiao-peng(Automated Institute,Nanjing University of Science and Technology,Jiangsu,Nanjing 210094)

机构地区：[1]南京理工大学自动化学院,江苏南京210094

出　　处：《新型工业化》2020年第4期104-108,共5页The Journal of New Industrialization

基　　金：工业和信息化部2018年工业互联网创新发展工程“面向电子行业安全技术典型应用推广项目”。

摘　　要：工业互联网的快速发展,使得电子邮件的使用频率显著提高,与此对应的邮件病毒也不断更新,使得邮件病毒的防治变得日益复杂。针对日益复杂的工业互联网邮件病毒防治工作,本文采用N-Gram算法构建了工业互联网邮件病毒特征库,在特征库基础上基于疾病传播模型构建了邮件病毒的传播和免疫自动行为。在五种不同工业互联网病毒类型的大量样本上生成了邮件病毒特征库,并根据工业互联网邮件病毒特征库分析了邮件病毒的自动传播和自动免疫过程。实验结果表明,本文方法生成的特征库具有良好的邮件病毒检测性能,并且对邮件病毒行为的分析能够更好的满足实际的邮件病毒防治工作。With the rapid development of the industrial Internet,the use frequency of e-mail has increased significantly,and the corresponding e-mail viruses are also constantly updated,making the prevention and treatment of e-mail viruses increasingly complicated.In view of the increasingly complex prevention and treatment of industrial Internet mail virus,this paper firstly uses N-Gram algorithm to construct the characteristic database of industrial Internet mail virus,and on the basis of the characteristic database,constructs the transmission and immune automatic behavior of mail virus based on disease transmission model.The mail virus feature library is generated on a large number of samples of five different industrial Internet virus types,and the automatic transmission and active immunity process of mail virus are analyzed according to the mail virus feature library of industrial Internet.The experimental results show that the feature library generated by this method has good detection performance of mail virus,and the analysis of mail virus behavior can better meet the actual mail virus prevention and control work.

关 键 词：邮件病毒 传播行为 免疫行为 病毒特征库 N-Gram算法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]