Worm detection and signature extraction was presented based on analysis of similar communication characteristics,which identifies the distinct communication pattern of worm spread,and evaluates the similarity metric of communication characteristic sets,and detects worms by detecting their infectivity with higher detection precision,generality and adaptability.Based on this,a heuristic detection framework is designed,which eliminates non-worm traffic from protocol,sequence,and content in three levels via blind,intent and lock track,then filters out worm packets and extracts signatures.The technique reduces data collection volume and analysis cost dramatically,and can detection worm and extract signature quickly in the environment with high strength background noise.
