An Overlay Network for Monitoring Activities of Computer Viruses  

作　　者：Li Ying Cao Yiqun Qiu Ben Jiao Jian Shan Xiuming Ren Yong 

机构地区：[1]School of Business,SUN YAT-SEN University, Guangzhou 510275, China [2]Department of Electronic Engineering, Tsinghua University, Beijing 100084, China

出　　处：《Engineering Sciences》2008年第1期52-58,共7页中国工程科学（英文版）

基　　金：Project is supported by the National Nature Science Foundation of China(Grant No.60672142,60772053,90304005);New architecture and technology for the Internet information sharing,The relation and Countermeasure of Application Layer Behavior and Collective Performance of Internet,Forecast of Traffic Model on Internet;Supported by National Basic Research Program of China,(Grant No.2007CB307100,Project No.2007CB307105);The Theory of Mobility and Sensor Network under The Integrated Network and the Universal Ap-plicable Service System

摘　　要：To accurately track computer viruses,an overlay network that monitors the activities of viruses is constructed.Identifying and locating nodes infected by virus on network is achieved by a naming system in which a node in the network is mapped to a unique serial number of the hard-drive.By carefully monitoring and recording sensitive communication between local system and remote nodes on the network,and suspicious operations on files that originate from remote nodes and entered via some form of file transfer,activities of viruses in both local and network level are recorded and ready for future analysis.These data can also be used in analysis of the mechanism of a computer virus as well as its spreading mode and pattern.

关 键 词：overlay network VIRUS OBSERVATION DNS 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP31[自动化与计算机技术—计算机科学与技术]