摘要
为在免疫机制生效前最大限度地控制邮件蠕虫的传播,提出了一种以动态分布的陷阱邮箱为基础的蠕虫邮件行为模式识别方法。该方法通过陷阱诱骗及行为模型匹配两个方面对蠕虫邮件进行互补过滤,克服了以往检测方法对传播延时较长的邮件蠕虫活动敏感度不高的缺点。模拟试验结果表明,对于不同传播因子的邮件蠕虫,新方法在控制病毒的传播上有显著的成效。
For the purpose of the furthest controlling E-mail worm＇s propagation before the immune mechanism came into force, this paper proposed a new method for identifying worm E-mail＇s behaviors based on dummy E-mail address, which could be assigned dynamically. By dummy luring and behavior models matching, complementary to each other, the new method can filter most of the worm E-mails, and overcome the shortcoming of the low sensitivity caused by the worm＇s long propagation lagtime. The test results show that the propagation of E-mail worm is well controlled by this means.
出处
《计算机应用》
CSCD
北大核心
2009年第8期2236-2239,共4页
journal of Computer Applications
关键词
蠕虫邮件
传播因子
陷阱邮箱
陷阱系数
行为识别
worm E-mail
propagation factor
dummy E-mail address
dummy factor
behavior recognition
