北京航空航天大学学报 ›› 2006, Vol. 32 ›› Issue (08): 998-1002.

• 论文 • 上一篇    

基于应用识别的P2P蠕虫检测

夏春和, 石昀平, 李肖坚   

  1. 北京航空航天大学 网络技术北京市重点实验室, 北京 100083
  • 收稿日期:2005-09-21 出版日期:2006-08-31 发布日期:2010-09-19
  • 作者简介:夏春和(1965-),男,江苏海安人,教授,xch@buaa.edu.cn.
  • 基金资助:

    航空基金资助项目(03F51060); 北京市教委共建项目建设计划基金资助项目(SYS100060412); 国防基础科研资助项目

P2P worm detection based on traffic classification and application identification

Xia Chunhe, Shi Yunping, Li Xiaojian   

  1. Key Laboratory of Beijing Network Technology, Beijing University of Aeronautics and Astronautics, Beijing 100083, China
  • Received:2005-09-21 Online:2006-08-31 Published:2010-09-19

摘要: 对等网中基于漏洞传播的P2P蠕虫是严重的安全威胁.根据P2P蠕虫的传播特点,提出了一种P2P蠕虫检测方法PWD (P2P Worm Detection).PWD主要由基于应用识别技术的预处理和基于未知蠕虫检测技术的P2P蠕虫检测2部分组成,改进了干扰流量的识别和过滤规则,提出了P2P蠕虫检测规则,并引进博弈论的研究方法讨论了检测周期的选取问题.仿真结果和局域网环境下的实验结果都表明,PWD是检测P2P蠕虫和遏制其传播的有效方法.

Abstract: P2P worm exploits common vulnerabilities in Peer-to-Peer networks. It is a severe security threat. A P2P worm detection method was presented, which called P2P worm detection(PWD) based on the worm′s propagation characteristics. PWD consists of a preprocess procedure which is based on application identification technology and a P2P worm detection procedure which is based on unknown worm detection technology. Improved heuristics was also advanced to identify and disturbing traffic was eliminated as well as heuristics to detect P2P worm. The selection of detection period was discussed by applying methodologies of game theory. Simulation result and LAN-scope experimental result both indicate that PWD is an effective method to detect and block P2P worm.

中图分类号: 


版权所有 © 《北京航空航天大学学报》编辑部
通讯地址:北京市海淀区学院路37号 北京航空航天大学学报编辑部 邮编:100191 E-mail:jbuaa@buaa.edu.cn
本系统由北京玛格泰克科技发展有限公司设计开发