【作者】 邓金鹏；

【导师】 牛连强；

【作者基本信息】 沈阳工业大学 ， 计算机应用技术， 2007， 硕士

【摘要】 在基于Internet的网络环境下,多样化的传播途径和复杂的应用环境使网络病毒发生频率增高、潜伏性变强、覆盖面更广,给网络造成了极大的危害。传统的病毒防治技术主要局限于单机病毒的查、杀,以及设置个人防火墙等,属于“被动的”防治技术,不能完全满足网络病毒防治的要求和有效地遏制大规模的网络病毒蔓延。本文的目的是应用旁路技术建立了一个基于核心层交换机的实时检测、针对网络病毒攻击特征构建的主动防御型网络病毒遏制系统。论文分析了网络病毒采用的传播模型和传播策略、技术以及作为对策的病毒遏制技术,尤其是对网络病毒自动检测技术和网络病毒遏制系统的构建方法进行了较深入的研究和分析。提出了采用基于误用检测与异常检测相结合的方法进行自动检测,以便及时发现网络流量中的异常,得出异常流量性质的思想,并由此出发构建了一个基于核心层的专门针对网络病毒的主动遏制系统。本文所设计的系统采用了这样的工作机理:在复杂的网络环境中,按照网络环境差异和系统的不同特征,可利用不同的网络病毒检测部件进行检测和利用不同的主机修复部件执行修复主机的任务。这不仅能够对网络中滞留的网络病毒进行有效控制,同时能够在疫情爆发的时候以指数方式生成大规模的执行修复主机任务的部件,在对网络几乎没有额外负载的情况下并行地和网络病毒进行对抗,从而能够有效遏制网络病毒的传播。另外,系统采用一定的状态检查的机制,保证了每个部件的自身安全和通信安全。更多还原

【Abstract】 The diverse propagation way and complex application conditions bring network virus eruption in frequency, latency and overcast, therefore the network virus do very serious crisis to the Internet. Traditional anti-virus technology confined to the single virus searches, killing, and the creation of personal firewall, belongs to "passively" the control technique , can not satisfy the network virus prevention completely the request and contains the large-scale network virus spread effectively.Aiming to establish the real-time of detection and defense network virus containment system, this article applies the bypass technology to establish based on the core switch. The paper has analyzed the dissemination model which and the dissemination strategy, the technology the network virus uses as well as takes the countermeasure the viral containment technology , especially has conducted the thorough research and the analysis to the network virus automatic detection technology and the network virus containment system’s construction method . This dissertation based on misuses the examination with the automatic detection technology which exceptionally examines unifies. It can promptly discover in the network current capacity unusual and points out the unusual current capacity the nature and building the system on the core switch to control for large-scale network virusThis system designed on base this work principle: according to the complex network environment and the different host information, different network virus detection components can be adopted and different host-recovering components can be created. In the proposed system, the host-recovering components can be created at an exponential rate while the epidemic situation is breaking out, which can be used to recover the hosts infected with network virus in parallel. Furthermore, the state-checking and the policy of authentication mechanism ensure the security of the components.更多还原