A NOVEL APPROACH TO DETECTING WORMS BASED ON PARTICLE FILTER

摘要：

This paper presents a novel approach to detecting worms based on particle filter. The approach collects data through honeynet and uses CUSUM to detect the abnormal changes of counts of packet source address in a t sampling. If the change rate exceeds a certain threshold, it will activate particle filter to estimate its growth rate in order to confirm the existence of worms. The experimental results show that the approach can detect unknown worms quickly and contain the large-scale spread of worms if it combines with the intrusion detection system and firewall.

关键词： worm Poisson process CUSUM (Cumulative Sum) particle filter

作者: Li Guoyou Zhong Lehai Yang Jun

作者单位: College of Computer Science, China West Normal University, Nanchong , Sichuan

会议类型: 国际会议

会议名称: 2009 2nd IEEE International Conference on Broadband Network & Multimedia Technology(2009年宽带网络与多媒体国际会议 IEEE IC-BNMT2009)

会议地点: 北京

会议语种:英文

页码: 429-432

在线出版日期: 2009-10-18（万方平台首次上网日期，不代表论文的发表时间）