Study Of Local Worm Detection And Defense Strategy Based On The Honeypot

With the wide applications of the Internet, Network to create more and more economic benefits and assume more social value,followed by more and more fierce attacks and the network of cyber crime. In the face of technology renovation, the ever-increasing attacks on computer network security ever more urgent and important. However, due to the reasons for the design of TCP / IP network protocol inherent security flaws and loopholes in the software system to the attacker with an opportunity, but also to network security research a challenge.In recent years, domestic and foreign governments, research institutions have attached great importance to the study of Internet worms, as well as defense-related technology. Network worms malicious code has become the primary subject of study. Internet worm is a Independent run can self-replicate and spread of the procedure, it's very harmful, given the outbreak of each society has brought about tremendous economic losses. At present, the development of the Internet worm appeared faster, more purpose and more advanced technical features. This article describes the work of the worm process. Analysis of the physical structure of the worm, At the same time, the worm out of the abstract features a unified structure of the model. Network worms but also some of the key technologies involved in the study,Including the spread of worms strategy, worms means of attack, the worm survival techniques and technology of selective attacks on four aspects.The paper consist of five chapters, The first chapter has introduced research background, the goal and the significance of the research and relevant situation. were studied, The second chapter has introduced worm ,including the concept of a variety of worms, the worm scans the strategy, the classification of worm, a typical worm attacks, network worms spread of the current model, as well as the main method of detecting worms and various methods of evaluation . The third chapter has introduced honeypot, including the concept of honeypot, honeypot of the various classifications of the current honeypot technology research hot spots. In the fourth chapter ,According to the current anti-worm technology always lags behind the worm outbreak of the current situation, Describes the need for initiative defense,Then introduced the real-time monitoring systems and technology-related content, And a description of the System,various modules designed to realize the localization of a prototype early warning network worms. In the fifth chapter ,Given system simulation environment, as well as the system of the testing process and results of the analysis, In conclusion, described the shortcomings of the system and the future prospects for further study.