基于网络行为模糊模式识别的蠕虫检测方法

Worm Detection Method Based on Fuzzy Pattern Recognition to Network Behaviors

网络蠕虫攻击由于危害大、攻击范围广、传播速度快而成为因特网危害最大的攻击方式之一。如何有效地检测网络蠕虫攻击是当前网络安全研究领域的一个重要方向。通过对网络蠕虫攻击行为的分析和研究,提出了一种根据蠕虫爆发时产生的典型网络行为来检测未知蠕虫的方法。该算法通过分别学习正常主机和受感染主机的网络行为建立相应的标准分类模糊子集,然后利用模糊模式识别法判定待测主机是否感染蠕虫。最后进行实验验证,结果表明,该方法对未知扫描类蠕虫有较好的检测效果。

Worms have been one range of victims and fast spread. of the most serious threats to Internet How to detect network worm attack is security due to the significant damage, large an important aspect of network security re- search area. This article proposed a method which detects worms by analyzing and studying typical network behaviors while worms burst out. The algorithm studies the network behaviors of normal and abnormal computer separately, es- tablishes standard fuzzy subsets of classification, and judges if the observation computer infects worms by utilizing fuzzy pattern recognition method. Finally, the experiment with the worm applications in the real world proves that this method is able to detect unknown scanning worms preferably.