基于支持向量机的蠕虫检测技术

Worm Detection Technology Based on Support Vector Machine

本文依据蠕虫扫描时会产生FCC失败连接概率高和FCC连接速度快这两个网络行为,通过使用支持向量机分别学习正常主机和受蠕虫感染主机的训练样本集,然后使用训练后的分类器对待测主机进行分类,实现了蠕虫攻击的自动检测,并进行了实验验证。实验结果表明,该方法对未知扫描类蠕虫有较好的检测效果。

This article is on the basis of the two network behavior about FCC high failure connection probability and connection speed while worms are scanning,by using support vector machine to study training sample set of the normal host and worm infected host respectively.Then it uses trained classifier to classify test host,realizing the worms attack automatic detection,and validated by experiment.The experimental results show that this method has good detection effect on the unknown scanning worms.