分布式蠕虫检测和遏制方法的研究

Approach to early detection and defense against internet worms

提出了一种分布式蠕虫遏制机制,它由两大部分组成:中央的数据处理中心和分布在各网关的感知器。中央的数据处理中心接收感知器的检测结果,并统计蠕虫的感染状况。分布在各网关的感知器监测网络行为并检测蠕虫是否存在。若检测到蠕虫的存在,感知器根据蠕虫的疫情状况,启动自适应的丢包机制。最后,实验结果证明了该遏制系统能够有效地遏制蠕虫的传播,保护网络的运行;尽可能小的干扰正常的网络行为。

A distributed defense mechanism was proposed. The main task of defense mechanism was to quickly detect worm attacks and response to constrain their propagation. The defense mechanism was composed of two parts： a date processing centre（DPC） and distributed sensors for defending against worm attacks. DPC is responsible for receiving the result of each distributed sensor and computing the number of infected computer. These distributed sensors monitor the network and detect worm. Once a worm attack was detected, a dropping packet mechanism is used so that the worm propagation was constrained, and the number of interference with normal activity is minimized. The experimental results prove the robustness and efficiency of the proposed defense mechanism.