基于人工免疫的未知木马检测系统研究与实现

【作者】 张红梅；

【导师】 范明钰；

【作者基本信息】 电子科技大学 ， 信息与通信工程， 2009， 硕士

【摘要】 普遍应用的计算机网络在给人们带来方便的同时,也带来大量病毒、木马和黑客入侵等,从而给人们造成巨大的经济损失。针对在网络信息系统的这些损失的调查结果表明在这些众多的安全问题中,木马占第一位。显然,木马的检测已经成为当前网络安全技术的研究重点。当前利用自然界的规律,将生物免疫原理应用在解决人类科学问题上已经成为一个新的发展方向。生物免疫系统所具备的自学习和自适应能力正好弥补了传统木马检测技术的缺陷。本文将人工免疫原理应用在木马检测技术中进行研究,完成了以下工作。首先,本文对传统木马检测技术和生物免疫系统的原理进行了研究,分析传统木马检测技术的缺陷。研究将人工免疫原理应用在木马检测中的可行性以及重要性。本文研究几种常见的人工免疫算法:阴性选择算法、克隆选择算法和动态克隆选择算法,总结其各自特性。其次,本文建立一个特殊的非我集用来保存与自我极为相似的非我,以解决部分匹配规则导致的漏洞问题。在自我耐受之前,首先让未成熟检测器与特殊非我集的非我元素进行匹配。若匹配,则不需要自我耐受,这样可以减少由于非我和自我极为相似产生的漏洞。本文分析实际网络活动的各个特征对网络行为有不同的判断力,如果算法中对各个活动特征做相同的处理,将会导致系统的检测率降低,误检率增加。本文针对特征字符串的不同属性设置不同的概率计算抗体亲和力。再次,本文分析在成熟检测器检测抗原时,如果成熟检测器在其生命周期内出现误检抗原,且其亲和力为0,则直接删除检测器。如果成熟检测器出现误检,但亲和力不为0,则变异生成未成熟检测器。在记忆检测器筛选过程中,筛选最近检测抗原的时间间隔较大的一部分记忆检测器,计算这一部分记忆检测器和动态非我集中非我的亲和力,变异亲和力为0的记忆检测器生成未成熟检测器,亲和力较小而不为0记忆检测器的加入成熟检测器。最后,本文在改进算法基础上,设计并实现在人工免疫原理上的木马检测系统,并通过实验测试系统性能。更多还原

【Abstract】 Huge economic losses are brought to people because of the viruses, Trojans, hackers and other malicious programs which are flooded in Internet which gives people lots of convenience. The truth that Trojan has caused people the biggest serious loss is confirmed by some surveys. The Trojan detection has been the focus of network security. Now it is a new way to solve the scientific problems based on the law of nature. The traditional Trojan detection can not detect Trojan self-learning and adaptive. The defects which belong to traditional Trojan detection are solved by biology immune system. Trojan detection based on artificial immune is researched in this paper.Firstly, the traditional technology of Trojan detection and the principle of biology immune system are analyzed. The defect that the traditional Trojan detection has caused is analyzed. The feasibility and significance of the artificial immune appliance in Trojan detection system are analyzed. Some normal artificial immune algorithms are introduced, such as negative selection algorithm, clone selection algorithm and dynamic clone selection algorithm. The features of the three algorithms are analyzed.Secondly, the special non-self set which is composed of the special non-self antigens which are similar with self antigens is added. If the antibody matches the special non-self antigen, the antibody needs not to be matched with self antigen. Because each feature of the actual network behaviors has not the same ability to judge the whole network behavior. If these features are processed equally, the detection rate will reduce and the false alarm rate will rise. The different rates of the different attribute fields are set to calculate the antibody affinity.Thirdly, if the affinity of the mature antibody which has detected the antigen which is not the non-self antigen is zero, the antibody needs to be removed. If the affinity of the mature antibody which has detected the antigen which is not the non-self antigen is not zero, the antibody needs to be variated to be a new immune antibody. a part of the memory antibodies which have not detected the non-self antigens for a long time needed to be selected to calculate their affinity. If the affinity is zero, the memory antibody needs to be variated to be a new immune antibody. If the affinity is not zero but small, the memory antibodies needs to be mature antibody.The Trojan detection system based on artificial immune is designed and implemented. The performance of the system is proved to be better than the traditional immune algorithms by the test of experiment.更多还原