摘要
网络蠕虫攻击是一种危害巨大且难以防御的网络攻击方式。传统的基于特征匹配的蠕虫检测方法受限于对蠕虫特征值的提取,无法检测未知类型蠕虫的攻击。在此将表征网络流量自相性的Hurst参数应用到蠕虫攻击检测,通过对Hurst参数的变化来检测未知类型蠕虫的攻击。实验表明该方法能有效检测到网络中采用主动扫描方式传播的未知类型蠕虫攻击行为。
Internet worms attack is harmful and difficult to defend. The traditional detection method based on feature matching is not suitable for detecting the attack launched by unknown worms since it requires worms＇feature extraction in advance. The Hurst parameter of network flow self similarity is applied to the detection of worms attack. The attack of the un known worms is detected by changing the Hurst parameter. Experimental result shows that unknown worms＇ attacks can be detected efficiently.
出处
《现代电子技术》
2011年第4期113-115,共3页
Modern Electronics Technique
基金
贵大自青基合字[2009]028号
关键词
网络蠕虫
攻击检测
网络流量
自相似性
Internet worms
attack detection
network flow
self similarity
