基于改进蚁群算法的多态蠕虫特征提取

发布时间：2018-03-15 04:30

本文选题：蚁群算法　切入点：序列比对　出处：《计算机应用》2013年12期 　论文类型：期刊论文

【摘要】：多态蠕虫特征提取是基于特征的入侵检测的难点,快速提取出精确程度更高的多态蠕虫特征对于有效防范蠕虫的快速传播有着重要的作用。针对层次式的多序列匹配(HMSA)算法进行多序列比对的时间效率较低和由迭代方法提取出的特征不够精确等问题,提出了基于改进蚁群算法的多态蠕虫特征提取方法 antMSA。该方法首先对蚁群的搜索策略进行了相应的改进,并将改进后的蚁群算法引入到奖励相邻匹配的全局联配(CMENW)算法中,利用蚁群算法快速收敛能力,在全局范围内快速生成较好解,提取出多态蠕虫的特征片段;然后将其转化为标准入侵检测系统(IDS)规则,用于后期防御。实验表明,改进后的蚁群算法能够较好地克服基本蚁群算法的停滞现象,扩大搜索空间,能够有效提高特征提取的效率和质量,降低误报率。
[Abstract]:Polymorphic worm feature extraction is a difficult problem in feature-based intrusion detection. Fast extraction of more accurate polymorphic worm features plays an important role in preventing the rapid propagation of worms. The time efficiency of multi-sequence alignment based on hierarchical multi-sequence matching algorithm is low. The features extracted by the generation method are not accurate enough and so on. An improved ant colony algorithm (ant MSA) is proposed to extract polymorphic worm features. Firstly, the ant colony search strategy is improved, and the improved ant colony algorithm is introduced into the global matching CMENW algorithm, which rewards the adjacent matching. Using the fast convergence ability of ant colony algorithm, the better solution is generated in the global range, and the characteristic fragment of polymorphic worm is extracted, and then it is transformed into standard intrusion detection system (IDS) rules for later defense. The improved ant colony algorithm can overcome the stagnation of the basic ant colony algorithm, expand the search space, improve the efficiency and quality of feature extraction, and reduce the false alarm rate.
【作者单位】：江西师范大学计算机信息工程学院;
【基金】：江西省自然科学基金资助项目(2011ZBAB211002)
【分类号】：TP393.08

【参考文献】