一种基于特征提取的高效蠕虫自动防御系统

Effective Worm Automatic Defense System Based Signature Generation

蠕虫的快速传播给因特网安全带来极大的挑战,设计和实现了一种有效的蠕虫检测和防御系统,提出二分聚类等方法改进了前期过滤和检测技术,有效降低后期处理数据量的同时提高了数据纯度,并提出一种基于Bloom Filter的位置相关的特征提取方法,降低资源消耗并产生更准确的特征.实验结果表明该系统能够有效地发现蠕虫活动并提取出准确的特征,实现基于内容特征的自动防御.

The fast spread of worm is a great challenge to Internet security. An effective worm detection and defense system is designed and implemented. A binary cluster algorithm is proposed to improve the front traffic filter, which reduce the traffic and enhance its purity. A method of position-aware signature generation based Bloom Filter is proposed to bring better performance and more accurate signature. Experiments show the system can effective detect worm traffic and generate accurate signature for content-based automatic defense.