蠕虫正则表达式特征自动提取技术研究

提出一种实用的蠕虫正则表达式特征自动提取方法，该方法由蠕虫传播网络流样本获取、特征树生成、高假阳性特征剔除、特征融合这4步组成。该方法的优点是可输出具有强描述能力的包含“.*”、“.{k}”、“|”、“(c){k}”等元字符的正则表达式特征。基于蜜罐系统Honeybow实现了该方法，并针对互联网上数种真实蠕虫进行了实验。实验结果表明，该方法可以准确地提取真实蠕虫的正则表达式特征，可以在蜜罐、蠕虫及恶意代码分析等系统中应用。

Automatic generating regular expression signatures for real network worms

A practical worm regular expression of automatic extraction method was presented,which involves four steps:sample collection from worm propagation, signature tre generation, removal of high false-positive signatures, and sig-nature merging. The advantage of this method is that it can directly output expression signature with the rich syntax of“.*”, “.{k}”, “|”, “(c){k}”. Based on the honeypot system Honeybow deployed in Internet, the method was implemented and evaluated by several in-wild worms under real Internet environment. The experiment results show that the method can generate accurate regular expression signatures for real worms and is promising for the applications of automatic analysis of worms and malwares.