基于统计分析建立流量动态临界线的蠕虫检测机制研究倡.pdf

文档介绍：第 27 卷第 3 .3
2010 年 3 月 Vol .2010No
Application Research puters Mar
基于统计分析建立流量动态临界线的
蠕虫检测机制研究倡
王勇超a , 谢永凯a , 朱之平a , 林怀忠b
(; .人工智能所, 杭州 310027)
a b
摘要: 提出了一种基于正态分布进行异常流量检测,从而判断当前内网中是否存在蠕虫感染的方法。该方法
根据历史流量的正态分布统计特性,计算出网络内数据流量的一般行为的可信区间,如果监控的流量超出该可
信区间,则判断为异常流量并作出蠕虫威胁的报警。结合该方法,进一步分析了如何以双因素模型分析网络中
蠕虫的数量。
关键词: 正态分布; 异常流量; 可信区间; 蠕虫
中图分类号: 393 文献标志码: 文章编号: 1001唱3695(2010)03唱1032唱03
TP A
: /. .
doi j issn
唱
Worm detection technology research flow dynamic critical
line established based on statistical analytic method
唱 a , 唱 a , 唱 a , 唱 b
WANG Yong chao XIE Yong kai ZHU Zhi ping LIN Huai zhong
( work Information, of Artificial Intelligence, Zhejiang University, Hangzhou 310027, China)
&
Abstract: 唱,
This paper raised a method. detect the flow based on normal distribution then, estimated the existence
of worm in work According to the normal, distribution character of the history flow this puted
the normal, behavior trusted zone of data flow in. network judged the inspected, flow abnormal flow if it went beyond唱 the trusted唱
zone and alarmed the threat of bined. with this method further analyzed how to use two factor model ana
lysis of the number of worms work
Key words: ; ; ;
normal distribution traffic statistic trusted zone worm
随着互联网的迅速发展及广泛普及,网络蠕