一种分布式蠕虫病毒检测系统

A distributed detection system for network worm

基于蠕虫病毒功能模块特点和发作特征,提出一种由索引服务器、超节点和节点构成的分布式蠕虫病毒检测系统模型.指出该系统应满足各个节点能同步更新节点信息,自主收集节点状态信息并进行判断,处理其他节点的判断结果等基本要求.以节点拓扑的生成为重点,讨论了分布式管理机制,信息在节点间的传递方法,安全管理和系统管理等问题.

Based on worm founctional modules and attack characteristics, an architecture model is presented, which belongs to a distributed worm detection system consisting of the index server, super - nodes and nodes. The system should meet the basic requirments of synchronized updating each node information, independently gathering and judging node status information, and dealing with judge results of other nodes. Taking node topology as an emphases, the paper discusses the distributed management system, information transfer method between the node safety nanagement and system management.