基于本地主机传播行为的蠕虫预警新方法.pdfVIP

第 28 卷第 5 期 通信学报 Vo 1.28 NO.5 2007 年5 月 Journa1 on Comrnunications May 2007 基于本地主机传播行为的蠕虫预警新方法 田俊峰，张弛，刘涛，李宁 (河北大学数学与计算机学院，河北保定071002) 摘 要:对于利用漏洞扫描技术传播的蠕虫进行预警，传统方法存在着诸如无法区分P2P 数据流，无法检测利用 多个端口传播蠕虫等问题。针对这些问题，结合对网络蠕虫行为模式的分析，提出了一种改进的算法，并建立了 基于该算法的预警模型。最后对该方法的可行性和各项性能进行了分析，发现新方法能更有效的预警未知的网络 蠕虫。 关键词:网络蠕虫:预警:传播行为:蜜罐 中图分类号: TP393.08 文献标识码:B 文章编号: 1000-436X(2oo7)05-oo80-10 Approach to worm early waroiog based 00 local victim behavior TIAN Jur卜feng， ZHANG Chi, LIU Tao , LI Ning (Institute of Computer Network Techno10gy, Hebei University , Baoding 071002, China) Abstract: Traditional algorithm to scanning worms early warning cant be used to distinguish P2P activity which can produce infection-like traffic , it also cant be used to forecast the multivector wo口ns which propagation by exploits several vulnerabilities. To settle 白is problem , aI) improved algorithm was developed and an early warning model was established based on the algori出m. At last, the feasibility of this method was analysed, by comparing with existing me由ods， the new approach become more efficient, and had the characteristic of issuing warning at the e缸ly stage of worm propagatlOn. Key words: Intemet worm; early warning; behavior; honeypot 万美元损失，到 CodeRed、 CodeRed 11 和 Nimda 蠕 1 引言 虫造成的数十亿美元的损失[2] ，近几年来，越来越 网络蠕虫是一种智能化、自动化，综合网络攻 多的蠕虫在互联网上出现，其传播速度也在呈几何 级增长，所造成的危害不断攀升，到现在己无法估 击、密码学和计算机病毒技术，不需要计算机使用