基于陷阱邮箱的蠕虫邮件行为模式识别方法  

New method for identifying behavior patterns of worm E-mail based on dummy E-mail address

作　　者：贾永新[1] 肖爱梅[1] 

机构地区：[1]山东理工大学计算机科学与技术学院,山东淄博255049

出　　处：《计算机应用》2009年第8期2236-2239,共4页journal of Computer Applications

摘　　要：为在免疫机制生效前最大限度地控制邮件蠕虫的传播,提出了一种以动态分布的陷阱邮箱为基础的蠕虫邮件行为模式识别方法。该方法通过陷阱诱骗及行为模型匹配两个方面对蠕虫邮件进行互补过滤,克服了以往检测方法对传播延时较长的邮件蠕虫活动敏感度不高的缺点。模拟试验结果表明,对于不同传播因子的邮件蠕虫,新方法在控制病毒的传播上有显著的成效。For the purpose of the furthest controlling E-mail worm＇s propagation before the immune mechanism came into force, this paper proposed a new method for identifying worm E-mail＇s behaviors based on dummy E-mail address, which could be assigned dynamically. By dummy luring and behavior models matching, complementary to each other, the new method can filter most of the worm E-mails, and overcome the shortcoming of the low sensitivity caused by the worm＇s long propagation lagtime. The test results show that the propagation of E-mail worm is well controlled by this means.

关 键 词：蠕虫邮件 传播因子 陷阱邮箱 陷阱系数 行为识别 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构] TP393.098[自动化与计算机技术—计算机科学与技术]