一种基于大型企业网的蠕虫早期实时检测方法

随着计算机网络的迅速膨胀,网络蠕虫攻击成为目前影响企业网络安全的一个重要问题。实时监视企业网的内外网络蠕虫和扫描攻击,特别是在蠕虫传播的早期检测到蠕虫。采取相应的防御措施,减少蠕虫传播和攻击扫描造成的损失变得尤为重要。提出了一种在企业网中早期的蠕虫检测算法。通过在Linux的平台下已实现的原型系统,验证了该算法的实时性和有效性。实验表明,当企业网感染了少量的魔波蠕虫时,该算法检测到该蠕虫,并获取了其传播特征以进行预警。

Real-time Early-stage Worm Detection Algorithm for Corporation Networks Method

With the rapid development of the Intemet, network worm attacks has become a main threath to the corporation security at present. It is very necessary to monitor the corporation network worm and scan attack and take measures of reducing the loss due to worm transmission and attack scan, especially in the early stage of worm transmission. A early-stage worm detection algorithm for corporation networks is proposed and the performance of real-time and validity is evaluated by experiments on Linux flat. The experiments show that the algorithm can detect the worm and obtain the transmission feature to alarm in advance when the network is affected by a litde worm moebot.