Abstract: With the unceasing development of the technology of Polymorphic worm, how to generate the signature of Polymorphic worm speedily and effectively is very important in the research area of the signature generation in IDS. This paper presents an automatic signature generation algorithm based on normalized local alignment algorithm. The highest similarity common subsequence is generated by sequence comparison of several suspicious Polymorphic worm flows. And the signature is presented by subsequence vector. The experimental results show this algorithm is effective than traditional method in false positive and false negative.

Key words: worm, signature generation, normalized local alignment, similarity metric

摘要： 随着Polymorphic蠕虫变形技术的不断发展，如何快速有效地提取其特征是入侵检测中特征提取领域的一个重要研究方向。采用基于模式的特征提取算法NLA（Normalized Local Alignment），通过对多个可疑Polymorphic蠕虫流量进行序列比对，自动提取高相似度公共子序列，以向量的形式构造蠕虫特征。实验结果表明该算法在误报率和漏报率方面均优于传统算法。

关键词: 蠕虫, 特征提取, 规格化局部比对（NLA）, 相似度度量