Research of Worm Intrusion Detection Algorithm Based on Statistical Classification Technology

Network worm is a common computer virus. Because it has characteristics of spread rapidly, intelligent attack and bigger destructiveness etc., this is an important issue of how to detect the worm virus intrusion, early warning and effective defense in network security of the future. In this paper through the analysis of worm detection technology and indexes, we propose a detection algorithm based on statistical classification which using heavy-tailed abnormal detection features of worm attack traffic in "the first connection", implement the algorithm´s performance analysis and comparison on the network security detection platform Bro.