基于扫描流量统计的本地网蠕虫检测方法  

Local Network Worm Detection Method Based on Scan Traffic Statistics

作　　者：巩永旺[1,2] 

机构地区：[1]盐城工学院信息工程学院,江苏盐城224051 [2]南京邮电大学计算机学院,江苏南京210003

出　　处：《计算机技术与发展》2011年第7期145-148,共4页Computer Technology and Development

基　　金：国家自然科学基金(60874091);江苏省"六大人才高峰"高层次人才项目(SJ209006)

摘　　要：为了准确检测外网蠕虫对本地网的传播,在研究蠕虫扫描行为模式的基础上,提出一种基于扫描流量统计的本地网蠕虫检测方法,并给出蠕虫检测方法实现的总体思路、关键算法和检测过程。该检测方法分为异常流量检测和扫描包特征匹配检测两个步骤,即首先使用马尔科夫和坎泰利不等式在网络边界检测进入本地网的扫描流量,提取异常流量中的可疑扫描包的特征;然后监控本地网,检测与可疑扫描包特征相匹配的本地网扫描活动,进而判定本地网是否感染外网蠕虫。分析与初步实验证明,该方法能够检测准确检测外网蠕虫对本地网的传播。In order to detect propagation of network worm from exterior network to local network accurately,a worm detection method based on scan traffic statistics was proposed after researching worm scan patterns,and the general ideal,key algorithms and worm detection process of which was discussed.The worm detection method consisted abnormal traffic detection and scan packets profile matching detection,which firstly detected abnormal scan traffic from exterior network to local network by the Markov＇s and Cantelli＇s inequalities,abstracting doubtful scan packets profiles from the abnormal traffic,and then through monitoring the local network and detecting the scan activities that matched the doubtful scan packets profiles,warned the propagation of worms from exterior network.The analysis and preliminary experimental results proved that the method can detect network worm from exterior network accurately.

关 键 词：蠕虫检测 扫描流量统计 马尔科夫不等式 坎泰利不等式 扫描包特征 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]