基于传播特性的蠕虫检测方法

A Worm Detection Method based on Propagation Characteristics

随着计算机网络技术的飞速发展,网络蠕虫攻击成为目前影响网络安全的一个重要问题。实时监视网络蠕虫攻击,特别是在蠕虫传播早期检测到蠕虫,以采取相应的防御措施,减少蠕虫传播和攻击造成的损失变得尤为重要。通过分析网络蠕虫在传播过程中具有扩散性、链型以及传输数据相似等特征,提出了一种基于蠕虫传播特征的检测方法。实验结果表明:该检测方法在一定程度上降低了蠕虫检测的漏报率和错误率,对未知蠕虫具有较好的检测能力。

With the rapid development of Internet,network worm attacks has became the main threat to network security at present.It is necessary to monitor the worm attacks,especially in the early stage of worm propagation,and take measures of reducing the loss caused by worm attacks.A method based on Propagation Characteristics for worm detection is put forward,through analyzing the worm characteristics of diffusing,the chain linking pattern and similarity of propagation data.The experimental results show that the method has advantages in decreasing the rate of omitting and mistakes,and detecting unknown worms to some degree.