基于贪婪算法的网络通信未知蠕虫检测仿真  

Simulation of Unknown Worm Detection in Network Communication Based on Greedy Algorithm

作　　者：杨鹏[1] 贺钧 李卫军 李娟[1] YANG Peng;HE Jun;LI Wei-Jun;LI Juan(School of Computer Science and Engineering,North Minzu University,Yinchuan Ningxia 750000,China)

机构地区：[1]北方民族大学计算机科学与工程学院,宁夏银川750000

出　　处：《计算机仿真》2024年第4期373-377,共5页Computer Simulation

基　　金：宁夏自然科学基金(2023AAC03310)。

摘　　要：网络蠕虫具有智能化和综合网络攻击性,无须计算机使用者干预即可运行的攻击程序或代码,且攻击传播速度较快。计算机防御模型多采用杀毒软件处理蠕虫的检测,但是无法提前防御蠕虫的攻击。因此,提出基于贪婪算法的网络通信未知蠕虫检测方法。通过云安全环境建立蠕虫传播模型,提取未知蠕虫数据特征,采用贪婪算法构建自编码器,降维蠕虫数据特征。利用改进蚁群算法和SVM建立网络攻击检测模型,将降维后蠕虫数据特征输入模型中,完成未知蠕虫的检测。实验结果表明,研究方法的蠕虫检测率更高,且丢包率低于0.5%,主机感染率降低,说明所提方法的应用性能更优。Network worms are intelligent and have comprehensive network attacks.They can run attack programs or codes without the intervention of computer users,and the attack spreads quickly.In this paper,a method of detecting unknown worms in network communication based on greedy algorithm was put forward.Firstly,a worm propagation model was built based on cloud security environment,for extracting unknown worm data features.Secondly,a greedy algorithm was adopted to build autoencoder,thus reducing worm data features.Then,an improved ant colony algorithm and a SVM were used to construct a model to detect network attacks.Finally,the worm data features after dimension reduction were input into the model,thus completing the detection of unknown worms.The experimental results show that the worm detection rate of the proposed method is higher,and the packet loss rate is lower than 0.5%.in addition,the decrease of host infection rate indicates that the application performance of the method is better.

关 键 词：蠕虫攻击 网络入侵检测 贪婪算法 自编码器 支持向量机 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]