计算机工程 ›› 2011, Vol. 37 ›› Issue (20): 139-141.doi: 10.3969/j.issn.1000-3428.2011.20.048

• 安全技术 • 上一篇    下一篇

未知蠕虫自动检测技术研究

佟晓筠,王 翥,赵章泉   

  1. (哈尔滨工业大学(威海)计算机科学与技术学院,山东 威海 264209)
  • 收稿日期:2011-05-12 出版日期:2011-10-20 发布日期:2011-10-20
  • 作者简介:佟晓筠(1963-),女,教授、博士生导师,主研方向:混沌密码学,网络安全;王 翥,教授;赵章泉,硕士
  • 基金项目:
    国家自然科学基金资助项目(60973162);山东省自然科 学基金资助项目(ZR2009GM037);山东省科技攻关计划基金资助项目(2010GGX10132);哈尔滨工业大学(威海)校科学研究基金资助项目(HIT(WH)2009)

Research on Unknown Worm Automation Detection Technology

TONG Xiao-jun, WANG Zhu, ZHAO Zhang-quan   

  1. (School of Computer Science and Technology, Harbin Institute of Technology at Weihai, Weihai 264209, China)
  • Received:2011-05-12 Online:2011-10-20 Published:2011-10-20

摘要: 现有蠕虫检测系统的误报率较高。为此,提出未知蠕虫自动检测技术。利用多维蠕虫异常检测方法发现未知蠕虫,使用跳跃式多特征串提取方法得到未知蠕虫的特征串集合,并生成相应的特征检测规则,实现未知蠕虫的自动检测。实验结果证明,该技术能够成功发现新型蠕虫,具有较高的蠕虫检测率和较低的误报率。

关键词: 未知蠕虫, 蠕虫检测, 特征提取, 异常检测

Abstract: Facing fast-spreading worms, existing detecting systems have lots of defects, such as high false alarm rate. For this reason, this paper proposes an automatic unknown worm detection technology, which uses multidimensional worm ab- normal detection method to discover unknown worms and uses salutatory multiple signatures extraction method to get the set of unknown worms’ signatures. It generates feature detection rules from signature set. It realizes automation of unknown worm detection using new rules. Experiments prove that, this technology can find the unknown worm, and has high detection rate and low false positive rate.

Key words: unknown worm, worm detection, feature extraction, abnormal detection

中图分类号: