基于Bro的蠕虫检测系统设计及实现

Design and Implementation of Bro-based Worm Detection System

在分析蠕虫传播机制基础上,基于入侵检测系统Bro的整体框架,以基于FCC(First Contact Connections,第一次连接)失败概率和重尾特性的蠕虫检测算法为核心,设计并实现了基于Bro的蠕虫检测系统。该系统对Bro的策略脚本解释器进行扩充,实现上述检测算法的策略脚本,将检测结果输出到共享内存,基于SNMP协议,将检测结果传送至监视端,方便用户对网络蠕虫的实时监视。该系统能够迅速准确地检测出网络上的蠕虫主机。

Based on the analysis of worm propagating mechanism and the framework of Bro--an intrusion detection system, the Bro-based worm detection system is designed and implemented. The failure frequency of FCC （First Contact Connections） and heavy-tailed property based worm detection algorithm is used as the kernel of the detection system. The detecting system extends the policy script interpreter of Bro, which sends the detecting results to the share memory based on the implementation of the policy script of the detecting algorithm. The results in the share memory are then sent to the monitor based on the SNMP, which is convenient for real-time monitoring the network worms. The worm detection system can detect network worm hosts quickly and accurately.