基于应用识别的P2P蠕虫检测.pdfVIP

2006 年 8 月 北 京 航 空 航 天 大 学 学 报 August 2006 第32 卷 第8 期 JournaI of Beijing University of Aeronautics and Astronautics VoI. 32 No. 8 基于应用识别的 P2P 蠕虫检测 夏春和 石昀平 李肖坚 （北京航空航天大学 网络技术北京市重点实验室，北京 100083） 摘 要：对等网中基于漏洞传播的 P2P 蠕虫是严重的安全威胁. 根据 P2P 蠕虫的传 播特点，提出了一种 P2P 蠕虫检测方法 PWD（P2P Worm Detection）. PWD 主要由基于应用识 别技术的预处理和基于未知蠕虫检测技术的 P2P 蠕虫检测 2 部分组成，改进了干扰流量的识 别和过滤规则，提出了 P2P 蠕虫检测规则，并引进博弈论的研究方法讨论了检测周期的选取 问题. 仿真结果和局域网环境下的实验结果都表明，PWD 是检测 P2P 蠕虫和遏制其传播的有 效方法. 关 键 词：P2P 蠕虫；蠕虫检测；应用识别 中图分类号：TP 393. 08 文献标识码：A 文 章 编 号：1001-5965（2006）08-0998-05 P2P worm detection based on traffic classification and application identification Xia Chunhe Shi Yunping Li Xiaojian （Key Laboratory of Beijing Network TechnoIogy，Beijing University of Aeronautics and Astronautics，Beijing 100083，China） Abstract：P2P worm expIoits common vuInerabiIities in Peer-to-Peer networks. It is a severe security threat. A P2P worm detection method was presented，which caIIed P2P worm detection（PWD）based on the worms propagation characteristics. PWD consists of a preprocess procedure which is based on appIication i- dentification technoIogy and a P2P worm detection procedure which is based on unknown worm detection tech- noIogy. Improved heuristics was aIso advanced to identify and disturbing traffic was eIiminated as weII as heu- ristics to detect P2P worm. The seIection of detection period was discussed by appIying methodoIogies of game theory. SimuIation resuIt and LAN-scope experimentaI resuIt both indicate that PWD is an effective method to detect and bIock P2P worm. Key words：P2P worm；worm detection；appIica