Worm detection using CPN
L. Peishun, Wang Jianbo, HE Da-ke · 2004
We use a combination of techniques from the behavior monitors and colored Petri net to detecting virus and worms. The malicious behavior is represented as Petri net and the notions of initial states and final state are used to define matching in this model. We generalize the model to deal with polymorphism of worms. However, it may generate many false alarms from normal activity. To solve this problem study mechanism is introduced into our model. The chief advantage of properly implementing our model is that it works for all worms - the ones that have been known currently and the ones yet to be discovered.