Research And Design Of A Worm Detection And Prevention System Based On Honeypot Technique

In recent years, with the rapid development of Internet, more and more applications and services are provided through the network, at the same time the security of the network also faces the enormous challenge . Especially following the appearance of the attack toolkits of worms and resources on how to code a worm, it is easier and easier to code a new worm, which leads to the result vast worms overrunning the Internet. The techniques used by worms are developing endlessly while the vulnerabilities becomes more and more. If more effective methods are not developed to detect and defend the worms, it's inevitable that not only great damage will be caused to the Internet, but also the people's convince to the healthy development of Internet will be vibrated seriously.A large number of research had been done to find how to detect and prevent network worm effectively and security systems such as firewall, intrusion detection system and virus defending system had been developed, however, all these systems mainly protect network using characteristic signature of known worms' attack , so that they can do nothing when a new-style worm arises. The presence of honeypot tris to change the passive situation of traditional network security by making the secure preventing to active which has bring up a new vital force to the security problem being in hot water.A honeypot is a security resource whose value lies in being probed, attacked, or compromised. This paper has researched on the honeypot technique and, based on the specialties worm's tranmitting method and working mechanism, and introduces a detecting and preventing system against network worm based on honeypot by combining the honeypot technology with intrusion detecting and preventing technology. The purpose of the system is to automatically detect and impede the outbreak of a new-style worm. Especially the system applies to contain the worm's spread at the early day and tries to capture the sample of worms. By distributing those worms' signatures using the Control...