| 基于行为序列灰色模糊判定的计算机木马检测方法 |
| |
| 引用本文： | 胡光俊,宋伟航,徐国爱.基于行为序列灰色模糊判定的计算机木马检测方法[J].北京理工大学学报,2011,31(5):567-571. |
| |
| 作者姓名： | 胡光俊 宋伟航 徐国爱 |
| |
| 作者单位： | 胡光俊,HU Guang-jun(北京邮电大学,网络与信息攻防技术教育部重点实验室,北京100876;公安部第一研究所,北京100048);宋伟航,SONG Wei-hang(公安部第一研究所,北京,100048);徐国爱,XU Guo-ai(北京邮电大学,网络与信息攻防技术教育部重点实验室,北京100876) |
| |
| 基金项目： | 国家"八六三"计划项目 |
| |
| 摘 要： | 针对计算机木马判定困难的问题,提出了一种对行为序列进行多属性灰色模糊木马判定的方法.通过对计算机木马定性分析构建了木马攻击树,归纳了木马使用攻击树叶子节点方法实现不同功能的概率等级.使用基于木马行为的检测技术检测出主机包含网络通信、隐蔽运行、开机启动、自我防护四要素的所有行为序列,视这些行为序列为木马设计方案,使用模糊数量化定性指标,将灰色系统理论与模糊优选结合,计算各方案的木马灰色模糊的优属度,最后使用危险指数进行木马判定.应用示例表明该方法可以有效区分正常程序,检出木马程序.
|
| 关 键 词： | 木马检测 木马攻击树 行为序列 模糊数 灰色模糊优属度 |
| 收稿时间： | 2010/9/22 0:00:00 |
Behavior Sequence Based Grey Fuzzy Determinant for Computer Trojan Detection |
| |
| HU Guang-jun,SONG Wei-hang and XU Guo-ai.Behavior Sequence Based Grey Fuzzy Determinant for Computer Trojan Detection[J].Journal of Beijing Institute of Technology(Natural Science Edition),2011,31(5):567-571. |
| |
| Authors: | HU Guang-jun SONG Wei-hang and XU Guo-ai |
| |
| Institution: | HU Guang-jun1,2,SONG Wei-hang2,XU Guo-ai1(1.Key Laboratory of Network and Information Attack & Defence Technology,Minstry of Education of China,Beijing University of Posts and Telecommunications,Beijing 100876,China,2.The First Research Institute of Ministry of Public Security,Beijing 100048,China) |
| |
| Abstract: | A multiple attribute grey fuzzy Trojan detecting method based on behavior sequence is proposed to solve the problems of Trojan detection.Through qualitative analysis,Trojan attack tree was constructed.The probability level,that Trojan can complete different functions by the method of using leaves node of attack tree,was summed up.Behavior sequences of Trojan,including network communication,hidden running,starting up after power on and self-protection,were considered as the designing scheme of Trojan.Then,by... |
| |
| Keywords: | Trojan detection Trojan attack tree action sequence fuzzy number grey fuzzy optimal degree |
| 本文献已被 CNKI 万方数据 等数据库收录！ |
| 点击此处可从《北京理工大学学报》浏览原始摘要信息 |
| 点击此处可从《北京理工大学学报》下载免费的PDF全文 |
|
