Network Worm Defense Research

Recently, attacks from network are growing greatly year by year,network worms of the computer system security and network security rhreats is increasing. These attacks have bring a great challenge to network security, but traditional firewall technologies, such as packets filter firewall and stateful inspection firewall, can't defense them efficiently. As an important part of network secuity system, firewalls must improve their abilities and new technology must be developed in order to defend these attacks which aim at application layer.Based on circumstances talked above, this paper puts forward a new-style, double-defence firewall framework based on Winsock2 SPI and NDIS-HOOK technology, and implement it in Windows. The main works of this paper are as follows:The important part of the study design an significance,introduce the worm definitions Designed and implemented the filtration and control of network packets in application layer. With this technology can be intercepted by all the network communication based on the Socket. Since the packets in this layer have not yet carried out in accordance with the lower section of the agreement, so it is easy to do content filtering.