Method for blocking worm propagation and device for implementing the same

Abstract

The invention provides a method for blocking the spreading of worm virus, which comprises that: a step of monitoring network data, all data packets in a two-layer network collision domain are monitored in the step; a step of judging a target MAC address to be a worm machine or not, the target MAC address of the monitored data packet is judged to be a host which is identified as a worm machine or not in the step; a step of judging to be an ARP broadcast packet of a normal host or not, if a non-worm machine is determined in the step of judging the target MAC address to be the worm machine or not, the data packet is judged further to be the ARP broadcast packet or not; a step of sending a masquerade ARP reply packet to the worm machine, if a worm machine is determined in the step of judging the target MAC address to be the worm machine or not, the masquerade ARP reply packet is sent to the worm machine, if a ARP broadcast packet is determined in the step of judging to be the ARP broadcast packet of a normal host or not, ARP reply packets disguised to be the normal host are sent to all worm machines determined to be existed in turn.

Description

technical field [0001] The invention relates to a method for blocking worm propagation and a device for realizing the method, in particular to a method for blocking worm propagation in computer network and data communication and a device for realizing the method. Background technique [0002] Since the emergence of a BSD Unix-based worm written by Morris on November 2, 1988, every worm outbreak has created huge economic losses. With the emergence of more and more worms, it has become an urgent problem to be solved to conduct in-depth research on worms and propose effective methods to block their propagation and provide a safe network environment. [0003] Worms usually use the network to spread specific information or errors, causing denial of network service or generating errors. At the same time, because of its rapid spread, it causes a large amount of network bandwidth consumption, which in turn causes abnormal network operation. One of the characteristics of worms is t...

AI Technical Summary

Problems solved by technology

Since this method is also set in the border area of ​​the network, it still cannot effectively block the worm activities inside the network

[0007] To sum up, traditional worm blocking methods can only block worm propagation between hosts that cross the two areas inside and outside the worm blocking host, and cannot effectively block worm propagation between internal networks.

Images