The Design And Implementation Of Hardware Worm Detecting System Based On FPGA

With the development and wide use of network, and the improvement of network openness, share ability and network interconnection, network security problems are increasingly serious. Malicious codes, such as virus and network worms, have become a common problem for all computer users. Because of the huge damage of network worm epidemics, how to detect and response network worms has become an important task in computer network security fields.The paper introduces the definition of worm according to the history of worm, analyses the worm's function module, attacking mode, scanning regulation and the typical worm-Sasser, then brings forward a worm-detecting algorithm based on packet statistics, by analyzing the detecting algorithm in existence. The observed data includes the number of receiving ICMP-T3 packets, the net traffic of distinct protocols, and the number of sending packets with the same destination port, the number of the SYN packets and UDP packets and the number of honeypot IP visited. All these observed results submit to software module through PCI module as an important parameter to judge whether the host infects worm. The arithmetic is simple and effective, suitable of being implemented by hardware.The paper designs a hardware worm detecting system, including GMII, receiving module, sending module, PCI module and software module. The whole design is described by using Verilog HDL. Finally, the design is simulated, synthesized and implemented on FPGA, which testifies the correctness of the design.The hardware detecting system can be embedded in network card, monitoring worm real time. Also it can be used in firewall with a little improvement. So the hardware worm detecting system based on FPGA will contribute to detecting and restraining worm.