基于AOI方法的未知蠕虫特征自动发现算法研究

An Automatic Worm Signature Extraction Algorithm Based on Attribution-Oriented Induction Method

近年来频繁爆发的大规模网络蠕虫对Internet的整体安全构成了巨大的威胁,新的变种仍在不断出现。由于无法事先得到未知蠕虫的特征,传统的基于特征的入侵检测机制已经失效。目前蠕虫监测的一般做法是在侦测到网络异常后由人工捕获并进行特征的分析,再将特征加入高速检测引擎进行监测。本文提出了一种新的基于面向属性归纳(AOI)方法的未知蠕虫特征自动提取方法。该算法在可疑蠕虫源定位的基础上进行频繁特征的自动提取,能够在爆发的早期检测到蠕虫的特征,进而通过控制台特征关联监测未知蠕虫的发展趋势。实验证明该方法是可行而且有效的。

The frequent explosion of massive worm propagation becomes a huge threaten to Internet security and caused countless losses. The traditional signature based IDS fails to detect new worm due the absence of the ability to detect characteristic of unknown worms. Currently, worm monitoring worm traffic after the early-bird system detected anomaly worm mainly depends on artificial analysis on the captured traffic and put the signature into the high speed detection system. This paper proposed an automatic worm Signature extraction algorithm based on Attribution-Oriented Induction method. It can detect worm signature using a Hash method in the early stage of worm propagation and then track the worm spread trend through signature correlation in the control center of system. The subsequent experiment result shows that the algorithm is feasible and effective.