噪音环境下的多态蠕虫特征自动提取算法研究

In order to prevent polymorphic worms from propagating rapidly, it is essential to generate worm signatures quickly and accurately. However, present signature generation approach can not generate effective polymorphic worm signature in noise environment. In this project, polymorphic worm signature generation approach in noise environment is researched mainly. The main research includes the following three aspects. Firstly, polymorphic worm signature model is built by adopting swarm intelligence modeling approach and utilizing stability of relationship between polymorphic worm bytes. Secondly, removing random noise method based on classification is proposed by appling local search technique of graph clustering, and the method is used to get rid of random noise in suspicious flow pool. Thirdly, by adopting coloring technique of parameterized complexity theory automatic signature generation algorithm in malicious noise environment is proposed, and disturbance of malicious noise to the process of signature generation is eliminated. On the basis of above research, polymorphic worm detection system is designed, which generates polymporphic signature by appling the proposed algorithms and detects network flow. The research results of this project will protect effectively network in practice.

快速而准确的提取蠕虫特征对于有效防御多态蠕虫的传播至关重要，但是现有特征产生方法在有噪音的环境下无法提取出有效的多态蠕虫特征。本项目主要研究噪音环境下的多态蠕虫特征自动提取方法。主要研究内容包括：参考群体智能建模方法，利用多态蠕虫负载字节之间关系的稳定性，建立噪音环境下的多态蠕虫特征模型；应用图聚类中的局部搜索技术提出基于分类的去随机噪音方法，去除可疑池中的随机噪音；借鉴参数理论的着色技术，提出恶意噪音环境下的多态蠕虫特征自动提取算法，去除恶意噪音对特征提取过程的干扰。在此基础上设计多态蠕虫检测系统，应用所提出的算法提取多态蠕虫特征，并对网络流量进行检测。本项目的研究成果将在实际应用中对网络起到有效的预警和保护作用。

快速而准确的提取蠕虫特征对于有效防御多态蠕虫的传播至关重要，但是现有特征产生方法在有噪音的环境下无法提取出有效的多态蠕虫特征。本项目主要研究噪音环境下的多态蠕虫特征自动提取方法。主要研究内容包括：利用多态蠕虫负载字节之间关系的稳定性，建立噪音环境下的多态蠕虫特征模型；应用图聚类中的局部搜索技术提出基于分类的去随机噪音方法，去除可疑池中的随机噪音；借鉴参数理论的着色技术，提出恶意噪音环境下的多态蠕虫特征自动提取算法，去除恶意噪音对特征提取过程的干扰。在此基础上,我们进一步对网络流量进行分析,应用机器学习方法对网络流量进行分类和聚类,并提取网络攻击流量的特征。本项目的研究成果将在实际应用中对网络起到有效的预警和保护作用。