基于事件序列的蠕虫网络行为分析算法

蠕虫以及其他一些恶意代码的更新速度越来越快，如何快速有效地分析大量恶意样本成为网络安全研究的一个问题. 因此提出了一种基于事件序列的蠕虫网络行为自动分析算法. 该算法依靠在实验环境中采集的纯净恶意流量，通过使用数据流的压缩归并等方法获取网络行为的基本轮廓以及网络特征码. 该算法的使用可以加快蠕虫等恶意代码的分析速度，提高防火墙以及网络入侵检测系统的配置效率.

Analysis algorithm for the worm metwork behavior based on event sequence

As the updating speed of the worm and other malicious codes grows faster and faster, how to analyze large sum of malicious sample quickly and effectively becomes an issue of research on internet security. Therefore, an analysis algorithm for worm network behavior based on event sequence was proposed. This algorithm uses the data flow recombination and compression methods to process the pure malicious data. With this procedure, it can get the network behavior profile and the signature of the worm. The application of this algorithm will greatly improve the efficiency of analyzing the worm network behavior, which will be significant for the deployment of firewalls and network invasion detection systems.