基于netflow数据流的蠕虫探测算法

随着网络的迅速发展,随之而来的网络安全事件日益突出,特别是以网络蠕虫为代表的异常流量。由于网络蠕虫能够在数分钟内感染网络上绝大多数有漏洞的机器,因此蠕虫探测系统必须能快速鉴别和隔离已感染蠕虫病毒的机器,特别是对感染新型的未知的蠕虫病毒的机器。鉴于此,我们提出了一种基于Netflow数据流的蠕虫探测算法,该算法能够探测出大部分蠕虫扫描,而且拥有非常高的效率和非常低的误报率。

.Netflow-based Arithmetic of Detected Worm

Network security events became more and more prominent with development of network,especially abnormal flows such as network worm.worm detection system must act quickly to identify and quarantine scan- ning worms,as network worm have been able to infect the majority of vulnerable hosts on the Internet in a matter of minutes.So we present a Netflow-based arithmetic of detected worm,this approach can detect most of scan- ning worm and have a high affectivity.