用户名: 密码: 验证码:
基于云计算的病毒恶意软件分析研究
详细信息    本馆镜像全文|  推荐本文 |  |   获取CNKI官网全文
摘要
目前反病毒软件仍然是广泛使用的检测病毒恶意软件的工具。然而传统检测方法的有效性一直被广泛的质疑。由于传统的检测方法不能够对新病毒和恶意软件进行有效的查杀,同时其逐步提高的复杂性也导致了其本身也容易被恶意软件攻击。云计算的出现改变了这一现状。
     云计算是分布式计算,网格计算,效用计算,虚拟化技术等计算机技术和网络技术发展融合的产物。它聚集大量计算机资源,通过互联网向普通用户提供各种IT服务,并按照使用量进行付费的一种模式。云计算可以向终端用户提供安全性的服务。云安全服务是指:使用大量的客户端对网络中软件行为进行异常的监测,得到网络中木马、蠕虫等病毒恶意软件最新的信息,然后将这些信息发送到云服务器端进行自动分析和处理,最后将这些病毒恶意软件的解决方案发到每一个客户端。
     本文将基于云计算的检测恶意软件病毒的方法同机器学习中算法分析理论相结合,利用了一种新式的分布式的CFO算法。该算法类似于粒子群算法是新型的基于天体物理学的多维搜索启发式算法,具有确定性的特点,利用一组质子在万有引力下的运动,在决策空间搜索最优解,而这组质子依据万有引力规则在空间移动。在本论文中对该算法进行了收敛性和正确性的证明,使得该算法的应用有了可靠地理论基础。然后将该算法进一步进行改进提出了分布式的CFO算法。由于该算法确定性的特点,所以该算法特别适合于训练神经网络分类问题。本文在云计算分布式环境中训练集成神经网络作为静态行为模式分类器,利用集成神经网络将可疑病毒文件和正常的可执行文件分类。
     另外,本论文通过最大独立集优化算法选择云中的虚拟机结点,安装商用杀毒软件实现并行分布式的对可疑文件进行全面的检测分析。同时利用云计算虚拟机结点的封闭式环境对可实现对病毒恶意软件的动态行为监测,在虚拟机封闭式的环境下观察其系统调用的行为,确定是否是病毒恶意软件。采用分布式波动PIF算法来形式化描述动态分析和分析报告返回的过程。依据分析的环境对波动算法进行相应的改进,也进一步提升了分析检测的效率。
     基于云计算平台的特点,本论文提出了云中病毒恶意软件检测模型的实施方案。与传统的病毒检测方法不同,该模型在每一个客户端主机运行一个轻型的主机代理程序,获取进入系统的可疑文件,发送这些文件到云端进行检测分析,然后根据返回的分析报告决定是运行还是隔离。在云端,该模型充分利用云计算分布式并行计算的特点,采用最大独立集算法优化云网络结构,选择出分布式虚拟机结点,在结点上分别安装不同的商用病毒恶意软件的检测引擎,用多个不同检测引擎对病毒恶意软件进行分布式的并行检测分析,最后的分析报告是综合了各个检测引擎的分析结果,发送给客户端主机代理软件。同时在基于云计算病毒恶意软件检测分析的服务中,对新的可疑文件还提供了两个行为分析引擎——动态行为分析引擎和静态行为分析引擎。
     目前只能在单机系统中对病毒恶意软件动态的分析一条程序执行的路径,误报率很高。为此,本文提出了基于云计算的动态行为分析方案,该方案利用云计算分布式计算的特点,在云计算多个虚拟机结点上并行的完成对病毒恶意软件多条执行路径的分析,对虚拟机中系统调用的监控发现病毒恶意软件在特定的条件下触发的恶意行为。采用PIF算法来形式化的描述可疑文件分析和报告返回的过程,对该算法的改进也同时提高了分析的效率,PIF算法是分布式算法特别适合在云计算环境中执行。实验结果表明,该模型能够检测出病毒恶意软件的条件触发行为,并且可以发现触发恶意行为的条件和满足这些条件的输入数据,同时基于云计算的动态监测的性能比普通单机系统有了较大的提升。
     当前几乎所有的对恶意代码的静态检测都是采用基于签名数据库的方式。这种方式导致了病毒恶意软件可以使用一些比较简单的方式来躲避检测,比如代码迷惑方式。针对这种情况,本文深入研究了集成神经网络作为模式识别器在病毒恶意软件静态检测中的应用,提出了一种基于云计算的静态行为检测的方式。与传统通过动态执行方法去获取系统调用序列不同,该方法通过基于n-grams的特征提取方法得到系统调用序列,使用特征提取和选择的算法得到可疑文件特征向量,作为训练测试的输入数据。通过对一种新式CFO算法进行比较详细的理论分析研究,在此基础上提出了一种新型的分布式的CFO算法,用于在云计算分布式计算环境中,对集成神经网络进行训练学习。文中最后基于云计算环境实现了集成神经网络对病毒恶意软件进行测试分类。实验结果表明,该方案与传统的静态检测方法比较有较高的精确度和较少的错误率。
Currently,antivirus software is one of the most widely used tools for detecting and stoppingmalicious and unwanted files.However, the long term effectiveness of traditional hostbased antivirusis questionable. Antivirus software fails to detect many modern threats and its increasing complexityhas resulted in vulnerabilities that are being exploited by malware. The emergence of Cloudcomputing changes present situation.
     Cloud computing is the development product of distributed computing、parallel computingand utility computing. It congregates large numbers of computation resources and provideson-demand IT services to the remote Internet users.Cloud can provide security services. CloudSecurity services: a large number of client ends monitor software actions,acquiring information aboutmalware and malicious codes,and sending it to cloud in order to analysis and processautomatically.Finally, the solution is allocated to all the client ends.
     This paper combines virus and malware detection based on cloud computing with algorithmanalysis theory in machine learning and uses a new Central Force Optimization algorithm.Thealgorithm is a new deterministic multi-dimensional search metaheuristic based on the metaphor ofgravitational kinematics. CFO is a deterministic algorithm that explores a decision space by “flying” agroup of “probes whose trajectories are governed by Newton’s laws.This paper prove the correctionand the convergence of CFO algorithm. The applications of CFO have reliable basis oftheory.Then,the algorithm is improved further.A distributed CFO is proposed.Because of deterministiccharacteristic, the algorithm is fit for training of neural network for classification problem.This papertrains the neural network ensemble as the pattern classifier of static behavioral analysis and uses theneural network ensemble to classify the suspicious files.
     This paper uses Maximal Independent Set algorithm to select virtual machine nodes and installsthe anti-virus software in the node to implement parallel distributed analysis. Meanwhile,the enclosedenvironment in virtual machine nodes is used to monitor dynamic behavior in order to identify virusand malware.The distributed Propagation of Information with Feedback (PIF) protocol algorithm isused to formally describe the procedure of dynamic analysis and analysis report return. According toanalysis environment,this paper improves the PIF and advances the analysis efficiency.
     On the basis of characteristic of cloud computing,this paper advocates a model for malwaredetection on end hosts based on providing antivirus as an in-cloud network service. We suggest that each end host run a lightweight process to acquire executables entering a system, send them into thenetwork for analysis, and then run or quarantine them based on a threat report returned by the networkservice.In the cloud network,this model,which uses maximal independent dominating set algorithm tooptimize the structure of network and to select the distributed virtual machine nodes, in whichmultiple commercial analysis engine are installed,enables identification of malicious and unwantedsoftware by multiple, heterogeneous detection engines in parallel. Furthermore, in networkcloud,there are two behavioral analysis engines which is dynamic analysis engine and static analysisengine.
     Virus and malware analysis is the process of determining the purpose and functionality of a givenvirus sample.Currently, The problem of dynamic analysis tools is that only a single program executionis observed,error rate is high. we propose a system,using cloud computer lots of resources,that allowsus to explore multiple execution paths and identify malicious actions that are executed only whencertain conditions are met. The distributed Propagation of Information with Feedback (PIF)protocol algorithm is used to describe analysis process.The improvement of the PIF advances analysisefficiency. The PIF is the distributed algorithm so that it is fit for cloud environment.Our experimentresults show that in many cases we can: detect the existence of trigger-based behavior, find theconditions that trigger such hidden behavior, and find inputs that satisfy those conditions and advanceits performance.
     Currently almost all static methods for detecting malicious code are signature-based, this leadsthe result that viruses can easily escape detection by simple mechanisms such as code obfuscation.This dissertation researchs the problem of neural network ensemble and application in static detection.Therefore,based on the cloud,a behavior-based detection approach is proposed to address this problem.Unlike the traditional approach, this approach statically analyzes binary code to derive system callsequences based on n-grams.In this dissertation,the author analyzes CFO convergence throughmathematics analysis of Celestial Mechanics.Based on it, distributed Central Force Optimizationalgorithm is proposed in order to train the ensemble neural network.Finally, This dissertationimplement classification of executables. The experimental results show that the proposed approachhas higher accuracy and a lower false positive rate than the other detection approach.
引文
[1] Qiang Duan, Yuhong Yan,Vasilakos, A.V. A Survey on Service-Oriented NetworkVirtualization Toward Convergence of Networking and CloudComputing. IEEETransactions on Network and Service Management,2012,9(4):373–392.
    [2] Grobauer, B, Walloschek, T, Stocker, E.Understanding Cloud Computing Vulnerabilities.IEEE Security&Privacy,2011,9(2):50–57.
    [3] Amanatullah Y,Lim C. Toward cloud computing reference architecture:Cloud servicemanagement perspective, International Conference on ICT for Smart Society,2013:1-4
    [4] Loughran, S,Alcaraz Calero, J.M,Farrell, A. Kirschnick, J.Dynamic Cloud Deployment ofa MapReduce Architecture.IEEE Internet Computing,2012,16(6):40–50.
    [5]冯登国,张敏,张妍,徐震.云计算安全研究.软件学报,2012,22(1):77-83.
    [6] Iosup A,Epema D. Grid Computing Workloads.IEEE Internet Computing,2011,15(2):19-26
    [7]胡华,庄毅,胡海洋,赵格华.网格环境下基于流水线的多重相似查询优化.软件学报,2010,1:55-67
    [8] Boss G, Malladi P, Quan D, et al. Cloud Computinghttp://download.boulder.ibm.com/ibmdl/pub/software/dw/wes/hipods/Cloud_computing_wp_final_8Oct.pdf.
    [9] Kwang Mong. Agent-Based Cloud Computing. IEEE Transactions on ServicesComputing,2012,5(4):564-577
    [10]罗军舟,金嘉晖,宋爱波,东方.云计算:体系架构与关键技术.通信学报,2011,32(7):3-21
    [11] IDC. http://www.idc.com/research/cloudcomputing/index.jsp.
    [12] Gartner.http://www.gartner.com/technology/research/cloud-computing/index.jsp.
    [13] Amazon EC2. http://aws.amazon.com/ec2/.
    [14] Lomotey R.K,Deters R. Middleware-Layer for Authenticating Mobile Consumersof Amazon S3Data. IEEE International Conference on Cloud Engineering,2013:108-113
    [15] Sanjay Ghemawat, Howard Gobioff, and Shun-Tak Leung The Google FileSystem.Proceedings of the nineteenth ACM symposium on Operating systems principles2003,37(5):29-43.
    [16] Fay Chang Jeffrey Dean Sanjay Ghemawat.Bigtable: A Distributed Storage System forStructured Data ACM Transactions on Computer Systems (TOCS),2008,26(2):205-218
    [17] Jeffrey Dean Sanjay Ghemawat MapReduce: simplified data processing on largeclusters.Communications of the ACM,2008,51(1):107-113
    [18] D.Chappell.Introduction to Windows Azure.2010.
    [19] Zibin Zheng.Component Ranking for Fault-Tolerant CloudApplications.IEEE Transactionson Services Computing,2012,5(4):540-550
    [20] GREENBERG A, HAMILTON J R, JAIN N, et al. VL2: a scalable nd flexible data centernetwork. Proceedings of the ACM SIGCOMM conference on Data communication,2009,39(4):51-62.
    [21] Yunfei Shang, Dan Li, Mingwei Xu. A Comparison Study of Energy ProportionalityofData Center Network Architectures. International Conference on Distributed ComputingSystems Workshops (ICDCSW),2012:1-7
    [22] Kui Ren, Cong Wang, Qian Wang.Toward secure and effective data utilization in publiccloud. IEEE Network,2012,26(6):69-74
    [23] About virtual machine templates.http://technet. microsoft.com/en-us/library/bb740838.aspx,2011.
    [24] Qian Wang,Cong Wang,Kui Ren,Wenjing Lou, Jin Li.Enabling Public Auditabilityand Data Dynamics for Storage Security in Cloud Computing.IEEE Transactionson Parallel and Distributed Systems,2011,22(5):847-859
    [25] ANDR H, LAGAR-CAVILLA S, WHITNEY J A, et al. SnowFlock: virtual machinecloning as a first-class cloud primitive. ACM Trans Comput Syst,2011,29(1):1-45.
    [26] Jiang, Chang-Shing Perng, Tao Li.Cloud Analytics for Capacity Planning and Instant VMProvisioning. IEEE Transactions on Network and Service Management,2013.10(3):312-325
    [27] Wen Chengjian, Long Xiang, Yang Yang, Fan Ni, Yifen Mu. System Power Modeland Virtual Machine PowerMetering for Cloud Computing Pricing. InternationalConference on Intelligent System Design and Engineering Applications,2013:1379-1382
    [28] Almorsy M.Collaboration-Based Cloud Computing SecurityManagement Framework.2011IEEE International Conference on Cloud Computing,2011:364–371.
    [29] Cloud Computing Alliance.http://www.cloud securityalliance.org/rsa2010.html.
    [30] Peidai Xie, Xicheng Lu. iPanda: A comprehensive malware analysis tool.InternationalConference on Information Networking (ICOIN),2013:481-486
    [31] Nari S, Ghorbani A. Automated malware classification based on networkbehavior.International Conference on Computing, Networking and Communications,2013:642-647
    [32] Kasama T,Yoshioka K. Malware Detection Method by Catching Their Random Behavior inMultiple Executions. International Symposium on Applications and the Internet,2012:262-266
    [33] S. Subashini, V. Kavitha. A survey on security issues in service delivery models of cloudcomputing.Journal of Network and Computer Applications,2011,34:1–11.
    [34] Behl A,Behl K. An analysis of cloud computing security issues.World Congresson Information and Communication Technologies,2012:109-114
    [35] Ntofon O D, Simeonidou D Hunter D K. Cloud-based architecture for deployingultra-high-definition media over intelligent optical networks. International Conferenceon Optical Network Design and Modeling,2012:1-6
    [36] Cloud Security Alliance. Security Guidance for Critical Areas of Focus in CloudComputing.http://www.clouds ecurityalliance.org/csaguide.pdf.
    [37] Cloud Security Alliance. Security Guidance for Critical Areas of Focus in CloudComputingv1.0.http://www.cloudsecurityalliance.org/guidance/csaguide.v1.0.pdf.
    [38] Jiadi Yu, Peng Lu, Yanmin Zhu, Guangtao Xue,Minglu Li. Toward Secure MultikeywordTop-k Retrieval over Encrypted Cloud Data.IEEE Transactions on Dependable and SecureComputing,2013,10(4):239-250
    [39] Lan Wu, Wei Zhang. A case study of hybrid WCET analysis for Xen virtulization.Proceedings of IEEE Southeastcon,2013:1-6
    [40] Wang W, Zhang X, Gombault S. Constructing attribute weights from computer audit datafor effective intrusion detection. Journal of Systems and Software,2009,82(12):1974-1981.
    [41] Kandukuri BR, Paturi VR, Rakshit A. Cloud security issues. IEEE international conferenceon services computing,2009:517–20.
    [42] Wonil Kima.An innovative method for data and software integration in SaaS.Computers&Mathematics with Applications,2012,64(5):1252–1258
    [43] Geric S, Vidacic T.XML digital signature and its role in information systemsecurity.Proceedings of the International Convention,2012:1520–1525
    [44] Lonea A M, Popescu D E, Prostean O. A survey of management interfaces foreucalyptuscloud. IEEE International Symposium on Applied Computational Intelligenceand Informatics (SACI),2012:261-266
    [45] Bertholon, B. Certicloud: A Novel TPM-based Approach to Ensure Cloud IaaSSecurity.IEEE International Conference on Cloud Computing,2011:121–130
    [46] Kourai, K. Azumi, T.; Chiba, S.A Self-Protection Mechanism against Stepping-StoneAttacks for IaaS Clouds. International Conference on Ubiquitous Intelligence&Computingand9th International Conference on Autonomic&Trusted Computing,2012:539–546
    [47] Ibrahim, A.S. Hamlyn-Harris, J.; Grundy, John; Almorsy, M. CloudSec: A securitymonitoring appliance for Virtual Machines in the IaaS cloud model.InternationalConference on Network and System Security,2011:113–120.
    [48] Sandikkaya, M.T.Security Problems of Platform-as-a-Service (PaaS) Clouds and PracticalSolutions to the Problems. IEEE Symposium on Reliable Distributed Systems,2012:463-468.
    [49] Gansen Zhao Ziliu Li; Wenjun Li; Hao Zhang; Yong Tang.Privacy Enhancing Frameworkon PaaS.International Conference on Cloud and Service Computing,2012:131–137.
    [50] Cloud computing comparison guide. Web hosting unleashed.http://www.webhostingunleashed.com/whitepaper/cloud-computing-comparison/
    [51] Comparison guide: Cloud computing. Focus research.http://www.focus.com/research/comparisonguide-cloud-computing/
    [52] Rimal BP,Choi E, Lumb I.A taxonomy and survey of cloud computing systems.proceedingsof the fifth international joint conference on INC, IMS and IDC,2009:44–51.
    [53] Bermbach D, Klems M,Tai S,Menzel M. MetaStorage: A Federated Cloud Storage Systemto Manage Consistency-Latency Tradeoffs.IEEE International Conference on CloudComputing (CLOUD),2011:452-459
    [54] Peng Liu, Yao Shi, Francis C. M. Lau, Cho-Li Wang, San-Li Li, Grid Demo Proposal:AntiSpamGrid. IEEE International Conference on Cluster Computing,2003.
    [55] Patrascu A, Leordeanu C, Cristea V. Scalable Service Based Antispam Filters.InternationalConference on Emerging Intelligent Data and Web Technologies (EIDWT),2011:192-197
    [56] Wenxuan Shi,aoqiang Xie.Spam filtering cloud platform based on sharingfingerprints.International Conference on Computer Science and Service System.2011:3570-3573
    [57] Skeirik S, Bobba R B, Meseguer J.Cluster, Formal Analysis of Fault-tolerant Group KeyManagement using ZooKeeper. IEEE/ACM International Symposium on Cloud and GridComputing (CCGrid),2013:636–641
    [58] Zhang Ying, Yang Xi.Improvement and optimization of spam text filteringsystem.20122ndInternational Conference on Computer Science and Network Technology (ICCSNT),2012:448-451
    [59] Jon Oberheide, Evan Cooke, and Farnam Jahanian. Rethinking antivirus: Executableanalysis in the network cloud.2nd USENIX Workshop on Hot Topics in Security,2007.
    [60] J. Oberheide et al. Cloud AV: N-Version Anti-virus in the Network Cloud. Proceedings ofthe17th Usenix Security Symposium,2008:91-206.
    [61] Carlos Rozas,Hormuzd Khosravi,Divya Kolar Sunder,Yuriy Bulygin.Enhanced Detection ofMalware.Intel Technology Journal,2009,13(2).
    [62] Xin Wang. Research on the anti-virus system of military network based on cloud security.2010International Conference on Intelligent Computing and Integrated Systems,2010:656-659
    [63] Salah, S.Smartphone cloud storage anti virus detection and prevention using robustalgorithm.8th International Conference on Computing and Networking Technology,2012:116-119
    [64] Salah, K.; Alcaraz Calero.; Zeadally, S.; Al-Mulla.Using Cloud Computing to Implement aSecurity Overlay. IEEE Network Security&Privacy,2013,11(1):44–53.
    [65] Nen-Fu Huang,Chia-Nan Kao,Rong-Tai Liu. A novel software-based MD5checksumlookup scheme for anti-virus systems. International Wireless Communications and MobileComputing Conference (IWCMC),2011:207-212
    [66] Batyuk L,Schmidt A.D, Camtepe S A,Albayrak S.An Android Application Sandbox systemfor suspicious software detection.International Conference on Malicious and UnwantedSoftware (MALWARE),2010:55-62
    [67] Wei Yan, Erik Wu.Toward Automatic Discovery of Malware Signature for Autivirus CloudComputing.Lecture Notes of the Institute for Computer Sciences, Social Informatics andTelecommunications Engineering,2009,4:724-728
    [68] Jia Xu,Jia Yan,Liang He,Purui Su CloudSEC: A Cloud Architecture for ComposingCollaborative Security Services. IEEE Second International Conference on CloudComputing Technology and Science,2010:703–711.
    [69] Elisa Bertino.Privacy-preserving Digital Identity Management for Cloud Computing. IEEEComputer Society Technical Committee on Data Engineering,2009.
    [70] Wang, S. Dey, S. Adaptive Mobile Cloud Computing to Enable Rich Mobile MultimediaIEEE Transactions on Multimedia,2013,15(99):870-883
    [71] JiSu Park.Markov Chain Based Monitoring Service for Fault Tolerance in Mobile Cloud Computing. IEEE Workshops of International Conference on Advanced InformationNetworking and Applications,2011:520-525.
    [72] Wang W, Li Z, Owens R, Bhargava B. Secure and efficient access to outsourced data.ACM cloud computing security workshop2007:63–69.
    [73] Sanka S, Hota C, Rajarajan M. Secure data access in cloud computing. IEEE internationalconference on Internet multimedia services architecture and application,2010:1–6.
    [74] Bethencourt J, Sahai A,Waters B.Ciphertext-policy attribute-based encryption. Proceedingsof the28th IEEE symposium on security and privacy,2007:1–6.
    [75] Kirby G, Deale A, Macdonald A, Fernandes A. An approach to ad hoc cloud computing.http://arxiv.org/abs/1002.4738v1.2010
    [76] Microsoft. Microsoft security intelligence report: July-decemberhttp://www.microsoft.com/technet/security/default.mspx, May2010.
    [77] Arbor Networks. Arbor malware library (AML). http://www.arbornetworks.com
    [78] Gartner, Inc. Forecast: Security software worldwide.http://www.gartner.com/DisplayDocument?ref=g_search&id=510567&subref=ad%vsearch,2007.
    [79] NIST/DHS/US-CERT. National vulnerability database. http://nvd.nist.gov/,2007.
    [80] Min Yu, Yuanzhuo Wang, Li Liu. Modeling and Analysis of Email Worm PropagationBased on Stochastic Game Nets.International Conference on Parallel and DistributedComputing, Applications and Technologies (PDCAT),2011:381-386
    [81] Barracuda Networks. Barracuda spam firewall. http://www.barracudanetworks.com,2011.
    [82] Van Lam Le, Welch I, Xiaoying Gao, Komisarczuk. A Novel Scoring Model to DetectPotential MaliciousWeb Pages.IEEE International Conference on Trust, Security andPrivacy in Computing and Communications,2012:254-263
    [83] Smaragdakis, G, Laoutaris, N,Lekakis, V,Bestavros, A,Byers, J.W. Selfish Overlay NetworkCreation and Maintenance.IEEE/ACM Transactions on Networking,2011,19(6):1624–1637
    [84] Mizutani, K,Matsuura, S. An Implementation and Its Evaluation of a Framework forManaging States of Nodes among Structured Overlay Networks.2010Sixth InternationalConference on Networking and Services,2010:282–287.
    [85] Bayer U.Exploiting diverse observation perspectives to get insights on the malwarelandscape.2010IEEE International Conference on Dependable Systems and Networks,2010:393–402.
    [86] Zesheng Chen,Chuanyi Ji. An Information-Theoretic View of Network-Aware MalwareAttacks.IEEE Transactions on Information Forensics and Security,2009,4(3):530–541.
    [87] Lewis C.A,Smith R.W. A model driven framework for N-version programming.2011IEEEInternational Systems Conference,2011:59–65.
    [88] Chitsaz, B.; Razzazi, M. Non-blocking N-version programming for message passingsystems MIPRO,2012Proceedings of the35th International Convention Publication Year:2012, Page(s):345-348
    [89] Yang Xu,Lei Ma,Zhaobo Liu,Chao, H.J. A Multi-dimensional Progressive Perfect Hashingfor High-Speed String Matching.2011Seventh ACM/IEEE Symposium on Architecturesfor Networking and Communications Systems,2011:167–177.
    [90] Xinchao Wang, Zhu Li,Lei Zhang,Junsong Yuan.Grassmann Hashing for approximatenearest neighbor search in high dimensional space.2011IEEE International Conference onMultimedia and Expo,2011:1–6.
    [91] Willems, C,Holz, T,Freiling, F. Toward Automated Dynamic Malware Analysis UsingCWSandbox.IEEE Security&Privacy,2007,5(2):32-39
    [92] Hong Jhe Li,Chia-Wei Tien,Chin-Wei Tien,Chih-Hung Lin,Hahn-Ming Lee. AOS: Anoptimized sandbox method used in behavior-based malware detection.2011InternationalConference on Machine Learning and Cybernetics,2011,1:404–409.
    [93]唐勇,周明天,张欣.无线传感器网络路由协议研究进展.软件学报,2006,17(3):410-421.
    [94] Sibichen S, Sreedhar S. An efficient AODV protocol and encryption mechanism forsecurity issues in adhoc networks. International Conference on Emerging Research Areasand International Conference on Microelectronics, Communications and Renewable Energy(AICERA/ICMiCR),:2013:1-6
    [95] RAJIV M,CHWFARANJAN M.Minimum connected dominating set using a collaborativecover heuristic for ad hoc sensor networks.IEEE Transactions on Parallel and DistributedSystems,2010,21(3):292—302.
    [96] D ZHANG Z,LI X.Better approximation algorithm for computing connected dominatingsets in unit ball graphs.IEEE Transactions on Mobile Computing,2010,9(8):1108-1118.
    [97] Sujay Sanghavi, Devavrat Shah, Alan Willsky. Message-passing for Maximum WeightIndependent Set. IEEE Transactions on Information Theory,2009,55(11):4822-4834.
    [98] Zhu X,Shen L,Yum T.Hausdorf clustering and minimum energy routing for wirelesssensor networks.IEEE Transactions on Vehicular Technology,2009,58(2):990—997.
    [99]杨阳,芮兰兰,郭少勇,邱雪松,亓峰.基于计时器的最小连通支配集生成算法.通信学报,2013,34(2):100-108.
    [100] KIM D ZHANG Z.Better approximation algorithm for computing connected dominatingsets in unit ball graphs.IEEE Transactions on Mobile Computing,2010,9(8):1108-1118.
    [101] DING L,WU W L.Eficient algorithms for topoiogy control problem with routing costconstraints in wireless networks.IEEE Transactions on Parallel and DistributedSystemsm,2011,22(10):1061-1069.
    [102] Mnif K,Rong B,and Kad och M.Virtual backbone based on MCDS for topology control inwireless ad hoc networks[.2nd ACM International Workshop on Performance Evaluation ofWireless Ad hoc,Sensor,and Ubiquitous Networks,2005:230-233.
    [103] W ightman P M,Fabregas A,and Labrador M A.An optima1solution to the MCDSproblem for topology construction in wireless sensor networks.2010IEEE Latin-AmericanConference on Communications,2010:1-6.
    [104]汪文勇,向渝,董传坤,杨挺,唐勇.用马尔科夫模型优化分布式最小连通支配集算法.电子学报,2010,1(38):2441-2446.
    [105] Namjoshi K,Narlikar G. Robust and Fast Pattern Matching for Intrusion Detection,2010Proceedings IEEE INFOCOM,2010:1–9
    [106] Xiaoheng Chen,Jingyu Kang,Shu Lin,Akella, V. Hardware Implementation ofa Backtracking-Based Reconfigurable Decoder for Lowering the Error Floor ofQuasi-Cyclic LDPC Codes.IEEE Transactions on Circuits and Systems I: RegularPapers,2011,58(12):2931-2943
    [107] Mathias Rauen. madcodehook. http://madshi.net/,2008.
    [108] Arbor Networks. Arbor malware library (AML). http://www.arbornetworks.com,2012.
    [109] Moskoviteh R,Feber C,Elovici Y.A chronological evaluation of unknown m~codedetection.Proc of the Pacific Asia Workshop on Intelligence and Security Informatics,2009:112-117.
    [110] Hsien-De Huang, Chang-Shing Lee, Hung-Yu Kao. Malware behavioral analysis system:TWMAN,2011:1-8
    [111] D. Brumley, C. Hartwig, Z. Liang, J. Newsome, D. Song, and H. Yin. TowardsAutomatically Identifying Trigger-based Behavior in Malware using Symbolic Executionand Binary Analysis. Technical Report,2007.
    [112]孔德光,谭小彬,奚宏生,宫涛,帅建梅.提升多维特征检测迷惑恶意代码.软件学报,2011,22(3):522—533.
    [113]刘巍伟,石勇,郭煜,韩臻,沈昌祥.一种基于综合行为特征的恶意代码识别方法.电子学报,2009,4:696-700.
    [114] C Kolbitsch,P M Comparetti,C Kruegel,E Kirda,X Zhou,X Wang.Efective and efficientmalware detection at the end host.InUSENIX Security Symposium,2009.
    [115] G Bonfante,M Kaczmarek,J Y Marion.Architecture of a morpholocal malwaredetector.Journal in ComputerVirology,2008,5(3):263—270.
    [116] Christodorescu M,Kinder J,.Malware normalization.Technical Report,Madison:Universityof Wisconsin,2005.
    [117] Zesheng Chen, Chuanyi Ji.An Information Theoretic View of Network-AwareMalware Attacks.IEEE Transactions onInformation Forensics and Security,2009,4(3):530-541.
    [118] Aoki K.,Yagi T. Controlling malware HTTP communications in dynamic analysis systemusing search engine.International Workshop on Cyberspace Safety and Security(CSS),2011:1-6
    [119] M. Jensen and N. Gruschka.Flooding Attack Issues of Web Services and Service-OrientedArchitectures.Proceedings of the Workshop on Security for Web Services andService-Oriented Architectures,2008:117–122.
    [120] M. Jensen, N. Gruschka, R. Herkenh.A survey of attacks on web services. ComputerScience-Research and Development,2009.
    [121] Khouzani M.Maximum Damage Malware Attack in Mobile WirelessNetworks.IEEE/ACM Transactions on Networking,2012,20(5):1347-1360
    [122] Moser A, Kruegel C, Kirda E. Exploring multiple execution paths for malwareanalysis.Proc of the2007IEEE Symp On Security andPrivacy,2007:231-240.
    [123] Willems C,Holz T,Freiling F.Toward automated dynamic malware analysis usingCWSandbox.IEEE Security and Privacy,2007,5(2):32—39.
    [124] Bayer U,Kruegel C,Kirda E.TTAnalyze:A tool for analyzing malware. Proc.of theEICAR,2006:180-192.
    [125] Bellard F.Qemu:A fast and portable dynamic translator. Proc.of the USENIX2005Annual Technical Cone on FREENIX Track,2005:41-46.
    [126] Aaraj N,Raghunathan A,Jha NK.Dynamic binary instrumentation—based framework formalware defense. Proceedings of the5th Int’1Conf.on Detection of Intrusions andMalware,and Vulnerability Assessment,2008:64-87.
    [127] Comparetti PM,Wondracek G,Kruegel C,Kirda E.Prospex:Protocol specificationextraction. Proc of the IEEE Symp.On Security&Privacy,2009:110—125.
    [128] Cui WD,Peinado M,Chen K,Wang HJ,Irun-Briz L.Tupni:Automatic reverse engineeringofinput formats.Proceedings of the ACM conference on Computer and CommunicationsSecurity,2008:391—402.
    [129] Saxena P,Sekar R, Puranik V.Efficient fine-grained binary instrum entation withapplications to taint—tracking. Proceedings of the6th Annual IEEE/ACM internationalsymposium on Code Generation and Optimization,2008:74—83.
    [130] J Tucek,J Newsome,S Lu,C Huang,S Xanthos,D mmley,D Song.Sweeper:Alightweight end-to-end s~tem for defending against fast worms. Proceedings of EuroSys,2007:115-128.
    [131] Dinaburg A,Royal P,Sharif M.Ether:Malware analysis via hardware virtualizationextensions. Proceedings of the15th ACM conference on Computer and CommunicationsSecurity,2008.
    [132] Wondracek G,M ilan P,Kruegel C,Comparetti P,Kirda E.Automatic network protocolanalysis.Proc.of the15th Annual Network&Distributed System Security,2008.
    [133] Lin ZQ,Jiang XX,Xu DY,Zhang XY.Automatic protocol format reverse engineeringthrough context—aware monitored execution. Proceedings of the15th AnnualNetwork&Distributed System Security Syrup,2008.
    [134] Kusumo Dana S,Staples, Mark, Zhu, Liming, He Zhang,Jeffery, Ross. Risks ofoff-the-shelf-based software acquisition anddevelopment: A systematic mapping study anda survey.International Conference on Evaluation&Assessment in Software Engineering,2012:233-242
    [135] Manawadu C D,Fernando S, Schmidt K,Perera H J. An empirical study on the importanceof quality among offshore outsourced software developmentfirms in Sri Lanka.InternationalConference on Computer Science&Education (ICCSE),2013:556-560
    [136] Nurmi D, Wolski R, Grzegorczyk C, Obertelli G, Soman S, Youseff L, Zagorodnov D.TheEucalyptus open-source cloud-computing system.Proceedings of the9th IEEE/ACMinternational symposium on cluster computing and the grid,2009:124–131.
    [137] L. Blin, A. Cournier, V. Villain.An improved snap-stabilizing PIF algorithm. Lecture Notesin Computer Science,2003:199–214.
    [138] A. Cournier, A. Datta, F. Petit, V. Villain.Snap-stabilizing PIF algorithm in arbitrarynetworks. Proceedings of the22nd IEEE International Conference on DistributedComputing Systems,2002:199–206.
    [139] Mehmet Hakan Karaata,Rachid Hadid.An optimal snap-stabilizing wave algorithm inarbitrary graphs. Computer Communications,2008,31:3071–3077.
    [140] Grégoire Jacob, Hervé Debar, Eric Filiol. Behavioral detection of malware: from a surveytowards an established taxonomy. Journal in Computer Virology,2008,4(3):251-266.
    [141] Lin Chen, Bo Liu, Huaping Hu, Qianbing Zheng. A Layered Malware Detection ModelUsing VMM.IEEE International Conference on Trust, Security and Privacy in Computingand Communications (TrustCom),2012:1259-1264
    [142] Shun-Te Liu, Hui-ching Huang, Yi-Ming Chen. A System Call Analysis Method withMapReduce forMalware Detection.IEEE International Conference on Parallel andDistributed Systems (ICPADS),2011:631–637
    [143] Cesare S,Yang Xiang,Wanlei Zhou. Malwise—An Effective and EfficientClassification System for Packed and PolymorphicMalware.IEEE Transactionson Computers,2013,62(6):1193–1206
    [144] Yanfang Ye,Tao Li,Qingshan Jiang,Youyu Wang. CIMDS: Adapting PostprocessingTechniques of Associative Classification for Malware Detection.IEEE Transactionson Systems, Man, and Cybernetics, Part C,2010,40(3):298-307
    [145] Zhiyong Shan, Xin Wang,Tzi-cker Chiueh. Malware Clearance for Secure Commitment ofOS-Level Virtual Machines.IEEE Transactions on Dependable and SecureComputing,2013,10(2):70-83
    [146] Imtithal A. Saeed Ali Selamat Ali M. A. Abuagoub.A Survey on Malware and MalwareDetection Systems. International Journal of Computer Applications67(16):25-31, April2013
    [147] Massicotte F.An analysis of signature overlaps in IntrusionDetection Systems. IEEEInternational Conference on Dependable Systems&Networks (DSN),2011:109-120
    [148] Yuxin Meng.Adaptive Character Frequency-Based ExclusiveSignature Matching Scheme inDistributed IntrusionDetection Environment.IEEE International Conference on Trust,Security and Privacy in Computing and Communications (TrustCom),2012:223-230
    [149] Sato, M, Yamaki H,Takakura H. Unknown Attacks Detection Using Feature Extractionfrom Anomaly-Based IDS Alerts.IEEE International Symposium on Applications and theInternet (SAINT),2012:273-277
    [150] SungRuoyu Zhang, Shiqiu Huang,Zhengwei Qi,Haibin Guan. Combining Static andDynamic Analysis to Discover Software Vulnerabilities. International Conferenceon Innovative Mobile and Internet Services in Ubiquitous Computing (IMIS),2011:175-181
    [151] Ye YF, Wang DD, Li T. An intelligent PE-Malware detection system based on associationmining. Journal in Computer Virology,2008,4(4):323-34.
    [152] Gregoire Jacob, Herve Debar, Eric Filiol. Malware behavioral detection byattribute-automata using abstraction from platform and language. Proceedings of12thInternational symposium on recent advances in intrusion detection,2009:81-100.
    [153] Peng W,Li F,Zou X, Wu J. Behavioral Malware Detection in Delay Tolerant Networks.IEEE Transactions on Parallel and Distributed Systems,2013,PP(99).
    [154] Hex-Rays SA. IDA pro introduction. http://www.hex-rays.com/products.shtml/.2011.
    [155] Ding Yuxin, Yuan Xuebing.Feature representation and selection in malicious code detectionmethods based on static system calls.compute rs&security,2011:514-524.
    [156] Saleh, M.E, Mohamed A B,Nabi A A. Eigenviruses for metamorphic virus recognition.IET Information Security,2011,5(4):191-198
    [157] Peid. Peid v0.94. Available From: http://www.peid.info/,2010.
    [158] O'Kane P,Sezer, S. Obfuscation: The Hidden Malware.IEEE Security&Privacy,2011,9(5):41-47
    [159] Aoki K, Yagi T.Controlling malware HTTP communications in dynamic analysis systemusing search engine.Third International Workshop on Cyberspace Safety and Security.2011:1–6.
    [160] Chang-Shing Lee.Malware behavioral analysis system: TWMAN Hsien-De Huang.2011IEEE Symposium on Intelligent Agent,2011:1–8.
    [161] Alsagoff, S.N.Malware self protection mechanism issues in conducting malware behaviouranalysis in a virtual environment as compared to a real environment. InternationalSymposium in Information Technology,2010,3:1326–1331.
    [162] DongHwi Lee, Won Hyung Park, Kim K J. A Study on Analysis of Malicious CodesSimilarity Using N-Gram and Vector Space Model. International Conferenceon Information Science and Applications (ICISA),2011:1-4
    [163] Yanfang Ye,Tao Li,Qingshan Jiang,Youyu Wang. CIMDS: Adapting PostprocessingTechniques of Associative Classification for Malware Detection. IEEE Transactions onSystems, Man, and Cybernetics, Part C: Applications and Reviews,2010,40(3):298–307.
    [164] R.A Formato.: Central Force Optimization: A New Metaheuristic with Applications inApplied Electromagnetics. Prog. Electromagnetics Research PIER,2007,77:425–449.
    [165] R.F. Tavares Neto,M. Godinho. An ant colony optimization approach to a permutationalflowshop scheduling problem with outsourcing allowed. Computers&Operations Research.2011,38(9):1286–1293.
    [166] SHEN Yuan-Xia,WANG Guo-Yin,ZENG Chuan o-Hua.Correlative Particle SwarmOptimization Model. Journal of Software,2011,22(4):695-708.
    [167] S. He, Q.H. Wu, J.R. Saunders, Group search optimizer: an optimization algorithm inspiredby animal searching behavior.IEEE Transactions on Evolutionary Computation,2009,13(5):973–990.
    [168] R.A Formato.Central Force Optimization with Variable Initial Probes and AdaptiveDecision Space. Applied Mathematics and Computation,2011,217:8866–8872.
    [169] K. R. Mahmoud. Central Force Optimization: Nelder-Mead Hybrid Algorithm forRectangular Microstrip Antenna Design. Electromagnetics,,2011,31(8):578-592.
    [170] Ali Haghighi,Helena M. Ramos: Detection of Leakage Freshwater and Friction FactorCalibration in Drinking Networks Using Central Force Optimization. Water ResourManage,2012,26:2347–2363.
    [171] Green,R.C.Training neural networks using Central Force Optimization and Particle SwarmOptimizatio.Expert Systems with Applications,2012,39(1):555-563.
    [172] Siegel C J,Moser J K.Lectures on Celestial Mechanics Springer.1972:208
    [173] Valsecchi, G. B., Milani, A., Gronchi, G. F., and Chesley, S. R. Resonant returns to closeapproaches: Analytical theory.Astronomy&Astrophysics.2003,408(3),1179–1196.
    [174] E.L.Stiefel and G.Scheifele﹐Linear and Regular Celestial Mechanics.Springer-Verlag﹐1971.
    [175] Huanhuan Chen, Xin Yao. Multiobjective Neural Network Ensembles Based onRegularized Negative Correlation Learning IEEE Transactions on Knowledge DataEngineering,2010,22(12):1738-1751
    [176] Huanhuan Chen, Xin Yao.Regularized Negative Correlation Learning for Neural NetworkEnsembles.IEEE Transactions on Neural Networks,2009,20(12):1962-1979
    [177] CoelhoL D S. Multiobjective Exponential Particle SwarmOptimization Approach Appliedto Hysteresis Parameters Estimation.IEEE Transactions on Magnetics,2012,48(2):283-286
    [178] dos Santos Coelho, L,Barbosa.Multiobjective Particle Swarm Approach for the Design of aBrushless DC Wheel Motor.IEEE Transactions on Magnetics,2010,46(8):2994–2997
    [179] John G,Vlachogiannis,Kwang Y Lee.Determining Generator Contributions to TransmissionSystem Using Parallel Vector Evaluated Particle Swarm Optimization.IEEE Transactionson Power Systems,2005,20(4):1765-1774
    [180] R A.Formato.Central Force Optimization with variable initial probes and adaptive decisionspace.Applied Mathematics and Computation,2011,217(21):8866–8872.
    [181] netlux.org. Malicious code samples. http://vx.netlux.org/.2010
    [182] Green, R.C Central Force Optimization on a GPU: A case study in high performancemetaheuristics using multiple topologies, IEEE Congress on Date of Conference,2011:550-557.

© 2004-2018 中国地质图书馆版权所有 京ICP备05064691号 京公网安备11010802017129号

地址:北京市海淀区学院路29号 邮编:100083

电话:办公室:(+86 10)66554848;文献借阅、咨询服务、科技查新:66554700