基于候选组合频繁模式的骨干网蠕虫检测研究

现有的网络蠕虫检测方法大多都是基于包的检测,针对骨干网IP流检测的研究较少，同时也不能很好地描述蠕虫的攻击模式。为此研究了一种在骨干网IP流数据环境下的蠕虫检测方法，通过流活跃度增长系数和目的地址增长系数定位可疑源主机，接着采用基于候选组合频繁模式的挖掘算法(CCFPM),将候选频繁端口模式在FP树路径中进行匹配来发现蠕虫及其攻击特性,实验证明该方法能快速地发现未知蠕虫及其端口扫描模式。

Detecting worms based on candidate combination frequent pattern in Internet backbones

The present worm detection methods have been mostly based on packets and less with IP flows in Internet backbones. They also cannot accurately describe the worm's scan-pattern. A method was presented to detect worms in Internet Backbones with flow data circumstance. First, find suspicious hosts by checking the increasing coefficients of Flow Activity Degree and Destination IP Address. Then, detect worms based on Candidate Combination Frequent Pattern Mining (CCFPM) algorithm. The results show that this meth...