应用改进的V-detector算法检测蠕虫

通过分析主机感染蠕虫后网络流量特性的变化，基于免疫系统的阴性选择机制，提出了一种蠕虫检测方法。首先改进了可变半径实值阴性选择算法V-detector，改进策略是在检测器生成过程中根据非自体空间的分布产生具有尽可能大覆盖范围的检测器。改进算法与原算法相比，所生成的检测器集合中检测器的数量大幅度下降，检测效率提高。应用改进的V-detector算法生成检测器集合监控主机的网络流量特性，以检测蠕虫攻击。实验结果表明，该方法能有效检测传统蠕虫及多维传播的多态蠕虫。

Worm Detection Based on Improved V-detector Algorithm

A host usually changes its network traffic characteristics when infected by a worm. From the observation, a worm detection method was proposed. It drew inspiration from the negative selection of the immune system. Firstly, V-detector algorithm—a real-valued negative selection algorithm with variable-coverage detectors was improved. The improved algorithm endeavored to generate large detectors according to the non-self space distribution. Compared with V-detector, the improved algorithm generated a much smaller detector set and increased the detection efficiency. Secondly, the improved V-detector algorithm was used to generate detector sets and monitor hosts’ network traffic characteristics for worm attacks. Experiments show that the method is effective to detect traditional worms as well as multi-vector polymorphic worms.