摘要
自动捕捉蠕虫是分析、遏制、对抗蠕虫的前提条件。通过深入分析各种实际蠕虫,提出了蠕虫传播的特性———异常数据来自不同的源地址,感染机发送相同的数据到大量目的地址。基于该特性,设计实现了基于蜜罐的蠕虫自动捕捉系统,系统自动分析发出和之前进入蜜罐机的数据包,通过特征分析和阀值比较,发现并捕获蠕虫。实验结果表明,系统可以获得良好的结果。
The automatic capture of the intemet worm is a pre-step to analyze, restrain and resist the worms. Through deep analysis of the real worms the features of the worm propagation are obtained： abnormal data coming from various source addresses and sending to diverse destination addresses. Based on those features the honeypot system to capture the intemet worm automatically is designed and implemented. The honeypot system analyzes the flow coming in and out of the sensor, then captures the suspicious worm flow by the feature comparison. The result shows that the system has good performance.
出处
《成都信息工程学院学报》
2007年第1期41-45,共5页
Journal of Chengdu University of Information Technology
关键词
网络安全
病毒防御
蜜罐机
蠕虫捕获
network security
worm vaccination
honeypot
automatic capture
