全部 标题 作者
关键词 摘要

OALib Journal期刊
ISSN: 2333-9721
费用:99美元

查看量下载量

相关文章

更多...

高速网络环境下的新型木马快速检测方法研究

, PP. 628-635

Keywords: 网络,木马,检测,正则表达式,有限状态自动机

Full-Text   Cite this paper   Add to My Lib

Abstract:

为了适应高速网络环境下的木马检测,通过分析传统的IDS,针对其在高速网络环境下对木马检测能力的不足,提出了单引擎大特征集的木马检测方法;通过分析木马的网络数据特征,对有限自动机转换过程进行优化,缩短了编译的时间,避免了重复匹配的问题,大幅度提高了基于正则表达式的木马检测方法的效率.关键词:网络;木马;检测;正则表达式;有限状态自动机

References

[1]  GILDER.G Telecosm: How infinite bandwidth will revolutionize our world[M].NewYork: The Free Press, 2000.
[2]  中国大陆地区2007年电脑病毒疫情和互联网安全报告[EB/OL].
[3]  [2008-02-.http://www.rising.com.cn/2007/annual/index.htm.
[4]  WEI S G, MIRKOVIC J.A realistic simulation of Internet?scale events[J].Proceedings of the 1st International Conference on Performance Evaluation Methodologies and Tools (Valuetools), Italy,2006.
[5]  Wu Naiqi,Qian Yanming,Chen Guiqing.A novel approach to trojan horse detection by process tracing[J].Proceedings of 2006 IEEE International Conference,2006:721-726.
[6]  Beyah R A,Holloway M C,Copeland J A.Invisible Trojan:an architecture,implementation and detection method[J].The 2002 45th Midwest Symposium on Circuits and Systems,2002(3):500-504.
[7]  Liu Ting, Guan Xiaohong, Zheng Qinghua, et al.Prototype demonstration:Trojan detection and defense system[J].Consumer Communications and Networking Conference,2009:1-2.
[8]  Moffie M,Cheng W,Kaeli D,et al.Hunting Trojan Horses[J].Proceedings of the 1st Workshop.Architectural and System Support for Improving Software Dependability,2006:12-17.
[9]  C Kruegel, T Toth, E Kirda. Service specific anomaly detection for intrusion detection[R]. Technical report, TU-1841-2002-28, 2002.
[10]  G Granger, G Economou, S Bielski. Self?securing network interfaces: What, why and how[R]. Technical report, Carnegie Mellon University, CMUCS-02-144, May 2002.
[11]  J Jung, V Paxson, A Berger, et al. Fast portscan detection using sequential hypothesis testing[J]. IEEE Symposium on Security and Privacy, 2004.
[12]  N Weaver, S Staniford, V Paxson. Very fast containment of scanning worms[J]. Proceedings of the 13th USENIX Security Symposium, 2004.
[13]  Schultz M, Eskin E, Zadok E, Stolfo.Data mining methods for detection of new malicious executable[J]. Proceedings of the IEEE Symposium on Security and privacy, Los Alamitos, CA, IEEE press,2001:38-49.
[14]  Cai M, Hwang K, Kwod YK, et al.Collaborative internet worm containment[J].IEEE Security & Privacy,2005,3(3):25-33.
[15]  AHO A V, CORASICK M J.Efficient string matching: an aid to bibliographic search[A]// Communications of the ACM 18[C].1975:333-340.
[16]  BOYER R S,MOORE J S.A fast string searching algorithm[A]// Communications of the ACM 20[C].1977:762-772.
[17]  张鑫,谭建龙,程学旗.一种改进的Wu?Manber多关键词匹配算法[J].计算机应用,2003,23(7):29-31.
[18]  代六玲,黄河燕,陈肇雄.一种改进的多模式串匹配算法[J].模式识别与人工智能,2006,19(1):47-51.
[19]  YANG D H,XU K,CUI Y.An improved wu?manber multiple patterns matching algorithm[A].Performance,Computing,and Communications Conference, 2006.
[20]  Jeffrey E F Friedl.Mastering regular expressions[M].Sebastopol ,CA : O''Reilly Media, Inc, 2006.
[21]  Yu Fang, Chen Zhifeng, Diao Yanlei.Fast and memory?efficient regular expression matching for deep packet inspection[C].EECS Department, University of California, Berkeley, Tech Rep: UCB/EECS-2006-76, 2006.
[22]  K Thompson.Regular expression search algorithm[J].Communications of the ACM, 1968,11(6):410-422.
[23]  陈火旺, 刘春林, 谭庆平, 等.程序设计语言编原理[M].北京: 国防工业出版社, 2003.
[24]  MIT DARPA Intrusion Detection Data Sets[DB/OL].
[25]  [2001-4-.http://www.ll.mit.edu/IST/ideval/data/2000/2000_data_index.html, 2000.

Full-Text

Contact Us

service@oalib.com

QQ:3279437679

WhatsApp +8615387084133