摘要
针对计算机木马判定困难的问题,提出了一种对行为序列进行多属性灰色模糊木马判定的方法.通过对计算机木马定性分析构建了木马攻击树,归纳了木马使用攻击树叶子节点方法实现不同功能的概率等级.使用基于木马行为的检测技术检测出主机包含网络通信、隐蔽运行、开机启动、自我防护四要素的所有行为序列,视这些行为序列为木马设计方案,使用模糊数量化定性指标,将灰色系统理论与模糊优选结合,计算各方案的木马灰色模糊的优属度,最后使用危险指数进行木马判定.应用示例表明该方法可以有效区分正常程序,检出木马程序.
A multiple attribute grey fuzzy Trojan detecting method based on behavior sequence is proposed to solve the problems of Trojan detection. Through qualitative analysis, Trojan attack tree was constructed. The probability level, that Trojan can complete different functions by the method of using leaves node of attack tree, was summed up. Behavior sequences of Trojan, including network communication, hidden running, starting up after power on and self- protection, were considered as the designing scheme of Trojan. Then, by the combination of grey system theory and fuzzy optimization method, the grey fuzzy optimal degree for each Trojan scheme can be calculated with the use of quantized qualitative index of fuzzy number. At last, Trojan was detected by comparing grey fuzzy optimal degree with the dangerous index. The example shows that above method can effectively distinguish the Trojan from normal program.
出处
《北京理工大学学报》
EI
CAS
CSCD
北大核心
2011年第5期567-571,共5页
Transactions of Beijing Institute of Technology
基金
国家"八六三"计划项目(2009AA01Z439)
关键词
木马检测
木马攻击树
行为序列
模糊数
灰色模糊优属度
Trojan detection
Trojan attack tree
action sequence
fuzzy number
grey fuzzyoptimal degree
