The Research Of Worm Detection Technique

Now, the latest virus technology is far advanced than the earlier virus that of ten years ago, the mainly difference is the emergence of worm technology and the more serious thing is the worm technology becoming more and more mature day by day, there are new worms emerged everyday and the worms become far more complicated. This article just aim at the condition analyzes the worm in the round and draw out the concrete worm detection realization method. The main ideas of this passage are listed below:Making a complete definition to worms by analyzed the traditional definition and comparing the similarities and differences between computer viruses and worm viruses, explaining the relationship about the worm and system vulnerability. By deeply analyzing the Nimda worm and Sasser worm, make a deep study for the propagation mechanism, attacking model and realizing technology of the worm, give the two level structure model of the worm, build up the worm's SIR model, analysis the worm's scanning technology in detail. Based on the traditional theory of IDS, study the system entropy which come from statistics model, and combined the worm behaviors characteristic, put forward the exponent entropy conception, deduce practical entropy value calculate formula, developed worm detection applied program.With building the LAN which test system needed and running the worm detecting system simulation test, we draw a conclusion that the worm detecting system given by this article is feasible and has high efficiency.