A hybrid algorithm for detecting computer worms

• Main Authors: Ying-Yu Chen, 陳英裕
• Other Authors: Chi-Chun Lo
• Format: Others
• Language: zh-TW
• Published: 2008
• Online Access: http://ndltd.ncl.edu.tw/handle/41684820970730514093

碩士 === 國立交通大學 === 管理學院碩士在職專班資訊管理組 === 96 === In recent years, some "Computer Viruses" of dispersal increases quickly on the network. Generally, computer viruses included various computer programs which have the ability to infection, replication and break or influence a computer‘s operate. Earlier computer viruses infection depends on file commutation, computer usually have the destructiveness of certain degree after infecting. For example: Can't boot, file damage, show error message and system resource overhead etc. Its form can be divided into these type: "Boot Viruses", "Windows Viruses", "Java/ActiveX Viruses", "Script Viruses", "Macro Viruses". Different from traditional computer viruses, the near future computer viruses ascends other computers by infection network through advanced infection skill. Its form can be divided into "PE program", "Trojans Horse Programs", "Spyware", “Computer Worm" and "Backdoors Programs" etc. Compare with the earlier computer viruses, these types computer viruses influence toward computer security and threat are rapid to increase. Currently the anti-virus software of widespread usage, the process of build virus pattern, deploy to computer and clear computer viruses still have time margin, this thesis begins the study of describe the become reason, characteristic, the way of spreads and infection, influence, threats and resolve solution of computer viruses. Then focused in to computer worms that with the best ability of infection and spread quickest. Through the “Hybrid Algorithm” by using “Negative form list“ and “Parallel ratio method” mixture with “Positive form list” and “Decision tree model” to detecting and analyzing computer worms. Through “Hybrid Algorithm”, we can detect the system abnormality quickly, when we analyzing it, this method also can define the characteristic of computer worms and produce a set of simple tool to help network administrator to clear computer worms in a short time, reduce the time to wait for update anti-virus pattern and can raise the protection ability of the operation system.