摘要： 根据网络蠕虫攻击的特点，建立了能够反映蠕虫扫描特征的失败连接流量(FCT)时间序列，提出了一种基于FCT时间序列小波包能量特征和支持向量机(SVM)的蠕虫检测新方法。该方法利用小波包分析计算FCT时间序列在各频带投影序列的能量分布，获得能够表征蠕虫扫描的特征向量，使用经过样本训练的SVM分类器进行分类，实现蠕虫攻击扫描的自动检测。实验结果表明，该方法能够比较准确地检测蠕虫攻击，和理论值相比，漏报率低于6%，误报率低于1%。

关键词: 蠕虫检测, 能量特征, 支持向量机

Abstract: To detect scanning network worm attack, failed connection flow(FCT) time series is established based on characteristics of worm attack, and a novel approach for worm detection based on energy features of FCT time series and support vector machine (SVM) is proposed. By computing the energy associated with each wavelet packet of FCT time series, this approach transforms the FCT time series into a series of energy distribution vector on frequency domain, then detects the worm using a SVM classifier. The experiment shows that the approach can detect worm attack effectively. Compared to theoretic value, the false positive rate is lower than 6%, and the false negative rate is lower than 1%.

Key words: Worm detection, Energy features, Support vector machine(SVM)