基于规则匹配的恶意代码检测方法研究与优化

发布时间：2018-10-07 19:39

【摘要】：随着网络规模的不断扩大以及网络技术的快速发展,恶意代码攻击呈现出专业性、趋利性与组织性的特点,从而给计算机安全与网络安全都带来了巨大的隐患。因此,必须对恶意代码进行检测,以避免计算机与网络遭到破坏,从而确保个人与企业的利益不受到损害。本文对基于规则匹配的恶意代码检测方法进行了深入的研究,并提出了基于频率统计的检测规则与高速的单模式匹配算法。论文的主要研究内容包括： 1、提出了异常网络行为的检测与优化方法。为了提高恶意代码的检测效率,就必须确保基于规则匹配的检测系统所用的规则集尽可能小而且有效。因此,本文首先对Snort系统的检测规则进行了细化,优化了检测规则树,然后把规则树中的规则进行匹配频率统计,将各端口下的三个规则子集进一步划分为常用子集与非常用子集,从而构造出更小更有效的规则集。 2、提出了高速的单模式匹配算法。通过对模式匹配算法BM算法、BMH算法、SBM算法了分析,提出了高速的单模式匹配算法。实验表明,HSPM算法通过综合使用BMH算法与SBM算法,从而实现了以更少的时间和匹配次数达到与BMH算法和SBM算法相同的识别率。 3、实现了基于QEMU的恶意代码原型验证系统。首先通过对QEMU源码的修改搭建了虚拟测试网络,然后对基于规则匹配的恶意代码原型验证系统的三个模块进行了实现,最后从四个方面对系统的性能进行了测试,测试表明本文所实现的系统达到了预定的设计目标与要求。
[Abstract]:With the continuous expansion of network scale and the rapid development of network technology, malicious code attacks show the characteristics of professionalism, profitability and organization, which bring huge hidden trouble to computer security and network security. Therefore, malicious code must be detected to avoid damage to computers and networks and to ensure that the interests of individuals and businesses are not compromised. In this paper, the detection method of malicious code based on rule matching is deeply studied, and the detection rules based on frequency statistics and the high speed single pattern matching algorithm are proposed. The main research contents are as follows: 1. The detection and optimization method of abnormal network behavior is proposed. In order to improve the detection efficiency of malicious code, it is necessary to ensure that the rule set used in rule-based detection system is as small as possible and effective. Therefore, this paper firstly refines the detection rules of Snort system, optimizes the detection rule tree, and then calculates the matching frequency of the rules in the rule tree. The three rule subsets under each port are further divided into common subsets and non-common subsets, thus a smaller and more effective rule set is constructed. 2. A high speed single pattern matching algorithm is proposed. Based on the analysis of BM algorithm, a high speed single pattern matching algorithm is proposed. The experimental results show that the HSPM algorithm can achieve the same recognition rate as the BMH algorithm and the SBM algorithm with less time and matching times by combining the BMH algorithm and the SBM algorithm. 3. The prototype verification system of malicious code based on QEMU is implemented. First, the virtual test network is built by modifying the QEMU source code, then the three modules of the prototype verification system based on rule matching are implemented. Finally, the performance of the system is tested from four aspects. The test results show that the system achieved the predetermined design goals and requirements.
【学位授予单位】：中国科学院大学（工程管理与信息技术学院）
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】