Detecting Email Worm through Contact-Tracing Chain
doi: 10.3969/j.issn.1001-0548.2011.03.021
- Received Date: 2009-11-18
- Rev Recd Date: 2010-07-12
- Publish Date: 2011-06-15
-
Key words:
- contact-tracing chain /
- detection /
- Email worm /
- entropy /
- simulation
Abstract: Email worms have recently become the most serious security threat on the internet. In this paper, a contact-tracing chain based framework (CTCBF) is proposed to detect this worm through tracing the contact behaviors among peers. This framework uses the contact tracing chain to trace abnormal peers which are screened out by isolated monitoring, and develops "difference entropy" to group peers with the same abnormal behaviors. Peers are confirmed with infectious symptoms when the length of contact tracing chain which they belong to reaches the preset threshold. Through numerical simulations, we demonstrate that the proposed contact tracing framework can quickly detect the propagation of Email Worm.
Citation: | HUANG Zhi-yong, ZENG Xiao-ping, ZHOU Jian-lin, SHI Xing-li. Detecting Email Worm through Contact-Tracing Chain[J]. Journal of University of Electronic Science and Technology of China, 2011, 40(3): 435-439. doi: 10.3969/j.issn.1001-0548.2011.03.021 |