一个分布式协作的大规模网络恶意代码检测系统

恶意代码已在网络中造成了严重的危害,对恶意代码进行有效地防治成了一项必需的研究. 研究了在大规模网络下,通过已知检测和异常发现两个模块,进行分布但自治式的检测,集中式的控制与分析模型. 异常发现模块采用可靠的技术,从网络中发现异常,并提交给分析控制中心;分析后将特征更新到已知检测模块的特征库中,实现将未知变为已知. 建立了系统模型,能够有效地发现新的疫情并及时地控制.

A distributed cooperative large network malicious code detecting system

The vicious codes have done serious harm to the computer and network systems.It is very necessary to research on protection system in the large network.The authors introduce a distributed broadband network protection system,which is composed of known check module and anomaly find module.The check is distributed and autonomous,but control and analysis are centralized.The anomaly find model uses reliable technology,and analyzes the data coming from the network and discovers the anomaly,commits the anomaly to analysis control center.After analyses,its character is updated to the known check module,that is,unknown anomaly can be changed into the known.The whole system is constructed,and can find epidemic disease effectively and put it out in time.