改进的蠕虫特征自动提取模型及算法设计

文章提出了一种基于序列比对的蠕虫特征自动提取模型，该模型针对现有蠕虫特征自动提取系统的可疑蠕虫样本流量单来源和粗预处理等问题，提出了对网络边界可疑流量和蜜罐捕获网络流量统一的聚类预处理，并使用改进的T-Coffee多序列比对算法进行蠕虫特征提取。实验分别对Apache-Knacker和TSIG这两种蠕虫病毒进行特征提取，从实验结果可以看出文章提出的模型产生的特征质量优于比较流行的Polygraph、Hamsa两种技术。

Improved Automatic Generation Model of Worm Signatures

This paper presents an worm signatures automatic generation model based on sequence aligment,it uses unified filting and clustering processing to enhance the suspicious traffic sample’s purtity,and with the modified T-Coffe multiple sequence alignment algorithm to generate worms signature.For comparative analysis of the signature generation model,this paper use two popular kinds of algorithms—Apache-Knacker algorithm and Hamsa algorithm—to capture the signature of Apache-Knacker and TSIG worms virus.According to the experiment result,the signature generation model which are proposed in this paper is superior to the other two kinds of technology.