Abstract: At present there arc some worm intrusion detection systems which detect network worms only by using worm propagation properties and have high false alarm rate. This paper analyzed worm non-linear propagation models, realized the optimization of worm model, and proposed distributed worm propagation model. Then a distributed worm detection technology was designed according to the distributed worm propagation model. The system uses rule-based detection method to monitor network worms, and the console side manages and coordinates detection work of the client sides. The experimental results show that the technology is a good solution to worm warning and worm detection, which can give an alarm with high detection rate and low false alarm rate.

Key words: Worm, Propagation model optimisation of worm, Worm warning, Distributed worm detection