Internet Worm Detection System Design on VC plus plus Platform

This paper designs and implements a network worm detection prototype system. The system includes four components: (1) the network status information collection subsystem, including two modules: monitoring module, to achieve real-time capture of network data packets from the network, and pre-process these data packets to form statistics information can be submitted; data storage module, to store the obtained network data. (2) Network status information statistics and analysis subsystem, including two modules: data statistics module, to count the flow feature properties and establish the feature set data; similarity calculation module, used to calculate the similarity of the current network data and feature set data. (3) Data output and display subsystem, including two modules: flow charts mapping module, to draw the similarity curves inside the two-dimensional coordinate figure inside the user interface; statistical result output module, to display the statistic results of the flow feature properties in computer screen. (4) Worm attack alarm subsystem, to give alarm when worm attacking.