通信学报Issue(3)：141-147,7.DOI:10.3969/j.issn.1000-436x.2013.03.018
蠕虫正则表达式特征自动提取技术研究
Automatic generating regular expression signatures for real network worms
摘要
Abstract
A practical worm regular expression of automatic extraction method was presented, which involves four steps:sample collection from worm propagation, signature tree generation, removal of high false-positive signatures, and sig-nature merging. The advantage of this method is that it can directly output expression signature with the rich syntax of“.*”,“.{k}”,“|”,“(c){k}”. Based on the honeypot system Honeybow deployed in Internet, the method was implemented and evaluated by several in-wild worms under real Internet environment. The experiment results show that the method can generate accurate regular expression signatures for real worms and is promising for the applications of automatic analysis of worms and malwares.关键词
蠕虫/恶意代码/特征提取/特征树/正则表达式/蜜罐/入侵检测Key words
worm/malware/signature generation/signature tree/regular expression/honeybow/intrusion detection分类
信息技术与安全科学引用本文复制引用
唐勇,诸葛建伟,陈曙晖,卢锡城..蠕虫正则表达式特征自动提取技术研究[J].通信学报,2013,(3):141-147,7.基金项目
国家高技术研究发展计划(“863”计划)基金资助项目(2011AA01A103) （“863”计划）
国家自然科学基金资助项目(61003303,61003217) （61003303,61003217）
