一种改进的蠕虫检测和遏制算法的仿真和评估

Simulation and Evaluation OF A New Algorithm of Worm Detection and Containment

通过对目前几种蠕虫检测和抑制策略的分析比较,提出了一种改进的两轮蠕虫检测和抑制算法,论证了这种算法对快速和慢速蠕虫检测和抑制的有效性,同时考虑了正常网络行为对该算法的影响,大大降低了该算法的误报率。最后,仿真实验分析了该算法在正常网络背景和网络拥堵背景下的检测蠕虫效果,证明了该算法策略能够高效地检测和抑制蠕虫,同时具有较好的低误报性。

Based on the comparison and analysis of many worm containment strategy, a new and effective strategy of worm dynamic defense and containment which is named IWDC is proposed in this paper. The effectiveness for containing top-speed scan worm and slow-speed scan worm is demonstrated. The impact of normal network traffic on the containment strategy is also analyzed so that it brings clown false positives largely. The simulation results verify that improved two-rotation quarantine algorithm can contain worms effectively and create lower false alarms.