一种基于序列比对的入侵特征提取算法

An Algorithm for Generation of Attack Signatures Based on Sequences Alignment

本文提出了一种新的基于多序列比对1的入侵特征提取算法。该算法包括两部分:基于局部比对的两序列比对算法SLA(Sequence Local Alignment)和多序列比对算法MSA(Multi-Sequence Alignment)。SLA算法借鉴了生物信息学中两序列比对的思想,用局部序列比对思想和仿射空位罚分模型代替了目前在攻击特征提取中常用的全局序列比对思想和权值恒定空位罚分模型,以提高攻击特征的泛化程度。MSA算法利用一种新的剪枝策略来提高现有多序列比对算法在攻击特征提取中的抗噪声能力。本文详细介绍了两个算法,并给出了算法分析,最后对算法的有效性、提取的攻击特征在检测中的有效性以及抗噪声能力进行了实验验证。

This paper presents a new algorithm for generation of attack signatures based on sequence alignment. The algorithm com- poses of two parts： a local alignment algorithm-SLA （Sequence Local Alignment） and a multi-sequence alignment algorithm-MSA （Multi-Sequence Alignment）. With the inspiration of sequence alignment used in Bioinformatics, S LA replaces global alignment and affine penahy model by local alignment and constant weight penalty model to improve the generality of attack signatures. MSA pre- sents a new pruning policy to make the algorithm more insensitive to noises in the generation of attack signatures. In this paper, SLA and MSA is described in detail and validated by experiments.