Worm's Research And Design On Worm's Early Warning Based On LAN

With the wide application of the Internet, worm's threat to security of computer system and security of network increases day by day. Especially under the environment of network, the diversified spread ways and the complicated applied environment make the emergence frequency of the network worm increase, the hiding becomes strong, the coverage rate is wider, losses caused are greater too.This article is a research thesis to the worm. The first half a part has carried on deeper research to various kinds of scanning tactics of the network worm, the classification of the worm, the spread model of the worm and existing main worm's detection method.Have concentrated on discussing a kind of new laws of police in advance of worm in the latter half of the thesis. In the stage of worm scaning, there will be similar among the communication chain of the nodes, and the communication mode of the flowers form appears, there will produce a lot of invalid connections at the same time because of some characteristics of worm's own activity. So we can measure to worm's behavior in worm's early activity, and there is better accuracy with feature detection. These will realize the early prewarning of the worm.According to the early warning model, we have designed and realized such a prototype system. This system gathers the dataflow of the local network, and analyses the data to judge whether it is a worm or not. And at the same time, the system sends out the early warning information.This paper consists of five chapters.The first chapter has introduced the background, the goal and meaning of the worm studies, and the relevant research situation. The second chapter has carried on research of various fields to the worm, including various kinds of the worm's concepts, scanning tactics of the worm, the classification of the worm, the attack course of the typical worm, the spread model of the worm, existing main worm's detection method and so on. The third chapter studied worm's prewarning method in the local network, and propose a kind of method of worm's prewarning on the basis of communication chain. In the fourth chapter, we have designed each module, and realized worm's early warning prototype. The fifth chapter summarizes the paper and indicates the future work.