Approach to worm early warning based on local victim behavior - TIAN Jun-feng; ZHANG Chi; LIU Tao; LI Ning (Tongxin xuebao)
Traditional algorithm to scanning worms early warning can’t be used to distinguish P2P activity which can produce infection-like traffic,it also can’t be used to forecast the multivector worms which propagation by exploits several vulnerabilities.To settle this problem,an improved algorithm was developed and an early warning model was established based on the algorithm.At last,the feasibility of this method was analysed,by comparing with existing methods,the new approach become more efficient,and had the characteristic of issuing warning at the early stage of worm propagation.