Immunity Based Worm Detection System  

作　　者：洪征 吴礼发 王元元 

机构地区：[1]Institute of Command Automation,PLA University of Science and Technology, Nanjing 210007,China

出　　处：《Journal of Beijing Institute of Technology》2007年第1期67-73,共7页北京理工大学学报（英文版）

基　　金：the National"863"Program Project (2002AA141090 ,2004AA147070)

摘　　要：Current worm detection methods are unable to detect multi-vector polymorphic worms effectively. Based on negative selection mechanism of the immune system, a local network worm detection system that detects worms was proposed. Normal network service requests were represented by self-strings, and the detection system used self-strings to monitor the network for anomaly. According to the properties of worm propagation, a control center correlated the anomalies detected in the form of binary trees to ensure the accuracy of worm detection. Experiments show the system to be effective in detecting the traditional as well as multi-vector polymorphic worms.Current worm detection methods are unable to detect multi-vector polymorphic worms effectively. Based on negative selection mechanism of the immune system, a local network worm detection system that detects worms was proposed. Normal network service requests were represented by self-strings, and the detection system used self-strings to monitor the network for anomaly. According to the properties of worm propagation, a control center correlated the anomalies detected in the form of binary trees to ensure the accuracy of worm detection. Experiments show the system to be effective in detecting the traditional as well as multi-vector polymorphic worms.

关 键 词：worm detection immune system negative selection 

分 类 号：TP274[自动化与计算机技术—检测技术与自动化装置]