一种基于进程流量行为的蠕虫检测系统.pdfVIP

CN43峭 1258/TP 2011 年第四卷第 4 期 计算机工程与科学 ISSN 1007-130X COMPUTER ENGINEERING . SCIENCE Vol. 33.No. 4.2011 文章编号: 1007-130X(2011)04-0019幽06 一种基于进程流量行为的蠕虫检测系统­ A Worm Dectection System Based on Process T raffic Behaviors 肖桐涛E ，王雄气刘波E ，陈新E XIAO Feng-taol ,WANG Weiz ,LIU 801 ,CHEN Xinl (1.阔防科学技术大学计算机学院，湖南长沙 410073;2. 辅州 611师部队，捕建福州 350003) ( 1. School of Computer Science，剖ational University of Defense T配hnology I Changsha 410073; 2. Corps 61198 ,Fuzhou 350003 ,China) 摘 要:随着蠕虫传播速度的不断加快，所造成的威胁也越来越大。为快速检测蠕虫，本文描述了和 蠕虫相关的三种重要的进程流量行为z 类蠕支流量中源端口总数、类蠕!k进程流量中源端口的变化频率以 及进程流囊中类蠕*流量占总进程流爱的总数。.1.于这三种行为，本文提出了-种基于进程流费行为的 蠕!k检测系统，同时介绍了该系统的相是定义、框架设计和关键实现。最后，采用真实程序进行了实岭，结 果在明该系统可以快速准确地检测蠕虫，并具有较小的谈报亭。 Abstract: With the propagation speed getting faster and faster , the damages caused by worms are getting more and more serious. To detect worms quickly , three worm-related process traffic behaviors are described: the total amount of source port in worm-like traffic , the change frequency of source port in worm幽like traffic and the ratio of worm-like traffic and total traffic for a single process. And based on the three behaviors. a worm detection system based on process traffic behaviors is presented and its defi- nitions. framework design and key implementation are a1so introduced. Finally , through experimenting with the worms and normal applications in the real world. the system is proved to be able to detect worms quickly and correctly , and has only few false positives. 关键词:蠕虫检测;进程流量行为;蠕虫行为;行为检测 Key words: worm detection; process traffic behavior; worm behavior; behavior