计算机科学 ›› 2015, Vol. 42 ›› Issue (3): 128-131.doi: 10.11896/j.issn.1002-137X.2015.03.026

• 信息安全 • 上一篇    下一篇

具有多区域选择性的网络蠕虫传播分析

张建峰,陈够喜,杨秋翔   

  1. 中北大学计算机与控制工程学院 太原030051,中北大学计算机与控制工程学院 太原030051,中北大学计算机与控制工程学院 太原030051
  • 出版日期:2018-11-14 发布日期:2018-11-14
  • 基金资助:
    本文受山西省科技攻关项目(20090322004),中北大学科学研究基金(2014)资助

Understanding Spread of Worms with Multi-area and Selectivity

ZHANG Jian-feng, CHEN Gou-xi and YANG Qiu-xiang   

  • Online:2018-11-14 Published:2018-11-14

摘要: 当今蠕虫不仅注重快速传播,而且根据不同 区域的特征能够实施选择性感染。首先,围绕这一特点,在AAWP离散模型的基础上,基于不同区域的漏洞分布概率,量化影响平均扫描率的若干因素,提出了一种多区域选择性蠕虫离散模型Areas-AAWP;其次,在该模型下,解析了多个子区域扫描策略之间的相关性,评判了整体区域中协同感染行为的相关度,并分析了该相关度对整体感染效率的影响;最后,通过实验证明,蠕虫的区域整体感染速率随多区域间扫描相关度的增大而上升,并随之形成明显的感染差异。

关键词: 离散模型,Areas-AAWP模型,多区域选择性,扫描策略,相关性

Abstract: Today worm not only spread more quicklying,but also can implement selective infection based on the diffe-rent characteristics of the regions.Firstly,on the characteristic,quantifying certain factors of the average scan rate based on AAWP model by the probability distribution of the vulnerability of different regions,we raised a multi-area and selective worm propagation model named Areas-AAWP with discrete time.Then,under this model,we analyzed the correlation between the scanning strategies adopted by each subarea,judged the degree of relevance to the whole infectious process between subareas,and analyzed the important impact on the overall efficiency of infection by this degree of relevance.Finally,the experiments testify that the whole worm infection rate increases with the degree of correlation among multi-zone scanning increases,and forms the obvious regional differences in infection.

Key words: Discrete model,Areas-AAWP,Multi-area and selective,Scanning strategy,Correlation

[1] Moore D,Shannon C.Code-Red:a case study on the spread and victims of an Internet worm[C]∥Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment.Marseille,France:ACM,2002:273-284
[2] Nazario J.The conficker cabal announced[EB/OL].http://www.asert.arbornetworks.com/2009/02/the-conficker-cabal-announced/,2009
[3] Kermack W O,McKendrick A G.Contributions to the mathematical theory of epidemics.II.The problem of endemicity[J].Proceedings of the Royal society of London,1932,8(834):55-83
[4] Chen Z,Gao L,Kwiat K.Modeling the spread of active worms[C]∥Twenty-Second Annual Joint Conference of the IEEE Computer and Communications(INFOCOM 2003).IEEE Societies,2003:1890-1900
[5] Zou C C,Towsley D,Gong W,et al.Routing worm:A fast,selective attack worm based on ip address information[C]∥Proceedings of the 19th Workshop on Principles of Advanced and Distributed Simulation.Washington,DC,USA:IEEE Computer Society,2005:199-206
[6] Li Y,Chen Z,Chen C.Understanding divide-conquer-scanningworm-s[C]∥Performance,Computing and Communications Conference,2008(IPCCC 2008).IEEE International,Austin,Texas:IEEE,2008:51-58
[7] Chen Z,Ji C.An information-theoretic view of network-awaremalware attacks[J].IEEE Transactions on Information Forensics and Security,2009,4(3):530-541
[8] Bose A,Shin K G.Agent-based modeling of malware dynamics in heterogeneous environments[J].Security and Communication Networks,2011,6(12):1576-1589
[9] Wagdarikar R R,C Maheshwar R,Raichurakar M A.Securing a Network by Modeling and Containment of Worms Using Preference Scanning[J].International Journal of Research in Computerand Communication Technology,2013,2(10):959-963
[10] 佟晓筠,李巧军.基于免疫主机的蠕虫非线性传播新模型优化[J].计算机科学,2013,9(5):99-101
[11] 苏飞,林昭文,马严,等.IPv6 网络环境下的蠕虫传播模型研[J].通信学报,2011,32(9):51-60

No related articles found!
Viewed
Full text


Abstract

Cited

  Shared   
  Discussed   
No Suggested Reading articles found!