中文摘要：

随着Polymorphic蠕虫变形技术的不断发展，如何快速有效地提取其特征是入侵检测中特征提取领域的一个重要研究方向。采用基于模式的特征提取算NLA（NormalizedLocalAlignment），通过对多个可疑Polymorphic蠕虫流量进行序列比对，自动提取高相似度公共子序列，以向量的形式构造蠕虫特征。实验结果表明该算法在误报率和漏报率方面均优于传统算法。

英文摘要：

With the unceasing development of the technology of Polymorphic worm, how to generate the signature of Polymorphic worm speedily and effectively is very important in the research area of the signature generation in IDS. This paper presents an automat- ic signature generation algorithm based on normalized local alignment algorithm. The highest similarity common subsequence is gener- ated by sequence comparison of several suspicious Polymorphic worm flows. And the signature is presented by subsequence vector. The experimental results show this algorithm is effective than traditional method in false oositive and false negative.