噪音环境下的多态蠕虫特征自动提取算法研究

项目名称： 噪音环境下的多态蠕虫特征自动提取算法研究

项目编号： No.61202495

项目类型： 青年科学基金项目

立项/批准年度： 2013

项目学科： 计算机科学学科

项目作者： 汪洁

作者单位： 中南大学

项目金额： 22万元

中文摘要： 快速而准确的提取蠕虫特征对于有效防御多态蠕虫的传播至关重要，但是现有特征产生方法在有噪音的环境下无法提取出有效的多态蠕虫特征。本项目主要研究噪音环境下的多态蠕虫特征自动提取方法。主要研究内容包括：参考群体智能建模方法，利用多态蠕虫负载字节之间关系的稳定性，建立噪音环境下的多态蠕虫特征模型；应用图聚类中的局部搜索技术提出基于分类的去随机噪音方法，去除可疑池中的随机噪音；借鉴参数理论的着色技术，提出恶意噪音环境下的多态蠕虫特征自动提取算法，去除恶意噪音对特征提取过程的干扰。在此基础上设计多态蠕虫检测系统，应用所提出的算法提取多态蠕虫特征，并对网络流量进行检测。本项目的研究成果将在实际应用中对网络起到有效的预警和保护作用。

中文关键词： 多态蠕虫；蠕虫检测；特征提取；蠕虫防御；异常流量

英文摘要： In order to prevent polymorphic worms from propagating rapidly, it is essential to generate worm signatures quickly and accurately. However, present signature generation approach can not generate effective polymorphic worm signature in noise environment. In this project, polymorphic worm signature generation approach in noise environment is researched mainly. The main research includes the following three aspects. Firstly, polymorphic worm signature model is built by adopting swarm intelligence modeling approach and utilizing stability of relationship between polymorphic worm bytes. Secondly, removing random noise method based on classification is proposed by appling local search technique of graph clustering, and the method is used to get rid of random noise in suspicious flow pool. Thirdly, by adopting coloring technique of parameterized complexity theory automatic signature generation algorithm in malicious noise environment is proposed, and disturbance of malicious noise to the process of signature generation is eliminated. On the basis of above research, polymorphic worm detection system is designed, which generates polymporphic signature by appling the proposed algorithms and detects network flow. The research results of this project will protect effectively network in practice.

英文关键词： polymorphic worm；worm detection；signature generation；worm defense；anomaly traffic