蜜罐自动捕获蠕虫病毒的设计和实现

自动捕捉蠕虫是分析、遏制、对抗蠕虫的前提条件。通过深入分析各种实际蠕虫，提出了蠕虫传播的特性——异常数据来自不同的源地址，感染机发送相同的数据到大量目的地址。基于该特性，设计实现了基于蜜罐的蠕虫自动捕捉系统，系统自动分析发出和之前进入蜜罐机的数据包，通过特征分析和阀值比较，发现并捕获蠕虫。实验结果表明，系统可以获得良好的结果。

Design and implementation of honeypot system of automatic capture of worm

The automatic capture of the internet worm is a pre-step to analyze,restrain and resist the worms.Through deep analysis of the real worms the features of the worm propagation are obtained: abnormal data coming from various source addresses and sending to diverse destination addresses.Based on those features the honeypot system to capture the internet worm automatically is designed and implemented.The honeypot system analyzes the flow coming in and out of the sensor,then captures the suspicious worm flow by the feature comparison.The result shows that the system has good performance.