一种基于Netflow的蠕虫攻击检测方法研究

Study of Worm-Attack Detection based on Netflow

文中在分析Netflow原理和蠕虫攻击行为特征的基础上,提出了一种基于Netflow的蠕虫检测方法。对检测算法中的流量异常和特征异常检测模块进行了编码实现,并搭建了相应的实验环境。通过模拟RedCode蠕虫爆发时的网络行为,实验结果表明:该方法可快速、准确地实现常见蠕虫的检测,对新型蠕虫也可实现特征提取和预警。

Based on analysis of the principle of Netflow and the behaviour characteristics of worm attack, a new wormattack detection method based on Netflow is proposed. The encoding on detection module of the traffic and characteristic anomalies is implemented, the corresponding experiment environment established, and the simulation of network behavior in occurrence of worm virus RedCode also done. The experimental results show that this detection method could quickly and accurately detect the common worm attack, including the feature extraction and the warning of the new-type worm viruses.