基亏并行计算的木马免疫算法研究

摘要

The traditional Trojan detection is short on detection accuracy, false positive rate and false negative rate. According to defect of traditional negative selection algorithm in detection efficiency, an improved algorithm based on parallel computing and multi-feature matching region is proposed. First, the algorithm divides a random string into multiple feature regions; each region corresponds to a set of detector. Among the regions, the algorithm does a second match with an r-continuous bits matching method. At the same time, under the parallel computing, algorithm sets a matching threshold to confirm the match experimental results show that, when the length of matching bit and random string is increased, the numbers of candidate detector has a fiat increase speed, the burden of system also has a slow increase speed. Therefore, the model has good detection efficiency.%传统的木马检测技术在检测正确率、误报率和漏报率上都有不足，针对传统阴性选择算法在检测效率上的不足，提出一种基于并行计算的多特征区域匹配算法。这个算法首先把随机字符串分为多个特征区域，每个特征区域内对应一个检测器集合进行匹配，而且特征区域之间采用r连续位匹配方式再次匹配，同时采用并行计算，设置匹配阈值进行匹配确认。实验证明改进的阴性选择算法在匹配位数和随机字符串住数增加时，候选检测器增加速度较平缓，系统负担增加较缓慢，因此具有较好的检测效率。