Method and system for automatically extracting worm features

Abstract

The invention relates to the technical field of information security, in particular to a method for automatically extracting worm features based on behavior trace analysis. The method comprises the following steps: modeling for the access habit of a network by learning the network traffic; detecting based on a CUSUM (cumulative sum) algorithm to determine that the flow which goes against a habit model in the network is a suspicious worm flow; defining and classifying behavior traces of network worms; performing correlation analysis on the behavior traces of the network worms by using Petri network in the suspicious worm flow; finally determining and extracting the feature codes of the network worms in the traces by applying an evaluation function. Experiments prove that the method can effectively and accurately extract the feature codes of the network worms. The following conclusion is obtained by combining theoretical analysis and experimental data: although identities of the worms cannot be accurately distinguished by the behavior traces of the network worms, the determination of the positions of the feature codes of the worms can be facilitated, so that the feature codes of the worms are effectively extracted.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and system for automatically extracting worm features based on behavior trace analysis. Background technique [0002] Since the Morris worm broke out in 1988, network worms have continuously threatened the security of the network. However, as the network is closely connected with people's economy and daily life, the outbreak of network worms often causes great harm to people's economic life. For example, the outbreak of the code red worm in 2001 cost people $270 million. In order to effectively suppress the spread of network worms, people began to pay attention to this field and did a lot of work. [0003] An ideal worm model can reveal the law of worm propagation, generate effective early warning of worm outbreaks and provide a theoretical basis for worm detection. Since the outbreak of the code red worm event in 2001, people have started to model and an...

AI Technical Summary

Problems solved by technology

Although traffic-based worm detection can quickly detect the existence of worms, it cannot provide worm signatures that people can reuse

Based on the IDS alarm, the behavior of network worms is analyzed, but because IDS can only identify known vulnerability attack codes and known attacks, it has certain limitations

Images