基于Windows主机的未知蠕虫主动检测系统

Host Based Unknown Worm Detection Using Machine Learning

相对于传统的反病毒软件,本研究提出了一种新的基于主机的蠕虫检测系统。这种新的检测方法通过分析监测已知蠕虫病毒对计算机性能参数造成的影响,对未知的蠕虫进行判决检测,达到网络预警的效果。我们通过监测主机的323个系统特征计数器以反应计算机的性能特征,并利用自行设计的对比特征选择系统对原始数据进行预处理。本研究采用贝叶斯网络分类算法对带有标签的各训练数据子集进行分类训练,产生用以判决未知蠕虫的分类判决规则。在模拟计算机各种应用状态下,我们在搭建的实验局域网上对这种新的监测系统进行测试评估。本研究提出的检测系统对采集的未知网络蠕虫达到80%以上的判决准确率,对已知蠕虫有着99%以上的检测准确率,有着很高的实用性和推广性。

Comparing to the common anti-virus tools, we propose a new host-based approach for detecting unknown computer worms based on the measurement of computer behaviors, rather than recognizing spe- cific instances of worms. We collected 323 features in order to reflect the computer behaviors and used a new feature selection method to reduce classified features. In the experiment, Bayesian Network theorem was applied on the several feature subsets to deduce the rule. We performed several experiments to evalu- ate the detection system, focusing on computer worms being injected in the computer while running several programs in order to simulate different background statuses. The average accuracy we achieved was above 80% for unknown worms sample and for known worms even above 99%.