【摘要】 提出一种综合采用网络蠕虫行为检测和网络蠕虫反馈检测的混合蠕虫检测方法.在网络蠕虫行为检测方面,将一个局域网作为一个访问模型对于蠕虫进行检测.在网络反馈蠕虫检测方面,利用网络对于蠕虫攻击反馈的信息作为网络反馈检测方法的特征.然后,通过CUSUM(Cumu lative Sum)算法将以上两种检测方法综合考虑来提高网络蠕虫检测的准确性.实验结果表明本文提出的方法可以准确高效地检测网络蠕虫.更多还原

【Abstract】 A hybrid worm detection approach which utilizes worm behavior and network feedback detection is presented.As for worm behavior detection,the local network is considered as an access model to detect worms.As for network feedback detection of worm,the feedback information which is generated by network is considered as the features of detection.Then CUSUM(Cumulative Sum) algorithm is utilized to improve the accuracy of worm detection by comprehensive consideration of the detection approaches above.The experimentation indicates that this approach can accurately and effectively detect Internet worms.更多还原