基于行为与贝叶斯分类的木马检测技术研究

发布时间：2018-12-22 09:31

【摘要】：计算机网络中存储的巨量有价值的资源信息让来自世界各地的不法分子虎视眈眈,他们一直致力于开发各种黑客技术或获取或破坏这些宝贵的资源信息,其中常用的就是木马技术,信息窃密网络入侵无时无刻不在发生着。而当前的木马查杀技术一直处于被动防御阶段,高漏报误报率、低查杀率,面对层出不穷的安全事件往往有些力不从心。行为分析技术通过分析总结木马行为特征,利用数据挖掘人工智能等方面的最新成果来检测木马特别是未知木马而成为木马检测技术的新星。但是当前对行为分析技术的研究还是比较初级的,基于此技术的检测系统存在着较高的漏报误报现象。因此,进一步研究木马行为,总结其行为特征,应用合适的智能分类算法以提高木马检测率,降低误报漏报率是十分有必要的。本文通过总结木马常见的行为建立行为特征库,围绕着对朴素贝叶斯分类器的改进和基于行为分析的木马检测技术进行研究,主要的研究内容如下三个方面：(1)总结木马常见的行为特征,建立木马行为特征库,利用内核挂钩技术提取程序的行为,形成程序的行为特征向量。(2)改进朴素贝叶斯分类器,对特征向量进行冗余、关联以及权重等方面的预处理,将与类别概率息息相关的系统风险等级VL与类别区分度息息相关的概念分类宽度δ引入分类器,并根据分类评估结果决定是否利用分类器的反馈自适应学习以适应行为特征的进化。(3)提出一种基于行为分析的木马检测模型,收集了较多的木马程序集,通过一系列的实验证明了本模型的可行性与有效性,并设计了与其它检测技术的对比实验,为基于行为分析的木马检测技术的研究提供了颇有价值的参考。
[Abstract]:The vast amount of valuable information stored in the computer network has been watched covetously by lawbreakers from all over the world, who have been working to develop hacking techniques or to acquire or destroy valuable resources. One of the commonly used Trojan horse technology, information theft network intrusion is taking place all the time. The current Trojan horse detection and killing technology has been in the passive defense phase, high false alarm rate, low kill rate, in the face of endless security incidents are often some unable to do. Behavior analysis technology by analyzing and summarizing Trojan horse behavior characteristics, using data mining artificial intelligence and other aspects of the latest achievements to detect Trojan horse, especially the unknown Trojan horse, and become a new star of Trojan detection technology. However, the current research on behavior analysis technology is still relatively primary, and the detection system based on this technology has a high false alarm phenomenon. Therefore, it is necessary to further study Trojan horse behavior, summarize its behavior characteristics, apply appropriate intelligent classification algorithm to improve Trojan horse detection rate and reduce false alarm rate. By summarizing the common behavior of Trojan horse and establishing the behavior feature library, this paper studies the improvement of naive Bayes classifier and the detection technology of Trojan horse based on behavior analysis. The main research contents are as follows: (1) summing up the common behavior characteristics of Trojan horse, establishing Trojan behavior feature library, extracting program behavior by using kernel hook technology, (2) improved naive Bayesian classifier to preprocess feature vectors in redundancy, association and weight, etc. The system risk level (VL), which is closely related to the classification probability, is introduced into the classifier, and the conceptual classification width 未, which is closely related to the classification degree, is introduced into the classifier. According to the results of classification evaluation, it is decided whether to use the feedback adaptive learning of classifier to adapt to the evolution of behavioral characteristics. (3) A Trojan horse detection model based on behavior analysis is proposed, and more Trojan horse assemblies are collected. A series of experiments have proved the feasibility and effectiveness of this model, and designed a comparison experiment with other detection techniques, which provides a valuable reference for the research of Trojan horse detection technology based on behavior analysis.
【学位授予单位】：广西大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP393.08

【相似文献】