结构化良性蠕虫的主动防御建模与对抗策略

95 浏览量更新于2024-08-31 收藏 202KB PDF 举报

本文主要探讨了"抵御蠕虫的结构化良性蠕虫的建模和分析"这一关键主题。在网络安全领域，由于良性蠕虫能够主动实施防御措施来对抗恶意蠕虫可能带来的破坏，它们的地位日益受到研究者的关注。作者 Hanxun Zhou、Wei Guo 和 Guodong Zhang 分别来自辽宁大学、沈阳航空航天大学的信息科学系，他们共同研究了如何设计和部署具有结构化的良性蠕虫，以及这些蠕虫的工作机制。论文的核心内容是针对蠕虫威胁，提出了一种结构化良性蠕虫的修补策略。通过构建传染性模型，研究人员深入剖析了如何有效地应用这种良性蠕虫来抑制恶意蠕虫的扩散。在这个过程中，模型着重考虑了两个关键因素：传感器的检测率和延迟时间。检测率决定了良性蠕虫能否及时发现并响应恶意蠕虫的攻击，而延迟时间则关乎反应速度和整体防御效果。通过模拟实验，作者们揭示了这两个参数对抵御蠕虫攻击的影响程度，这对于理解和预测良性蠕虫在对抗蠕虫传播中的行为至关重要。这篇论文不仅提供了一种新型的网络安全防护策略，还通过理论建模和实际仿真验证了其有效性。它对于网络管理员、安全研究人员以及整个IT行业来说，都具有重要的实践价值，因为理解如何利用结构化良性蠕虫进行动态防御，可以帮助减少蠕虫攻击造成的潜在损失，并提升网络安全的整体防护水平。

Modeling and Analysis of Patching Structured

Benign Worms Countering against Worms

Hanxun Zhou Wei Guo Guo dong Zhang

Department of Information Science Department of Computer Science Dept. of Information Science

and Technology and Technology

LiaoNing University Shenyang Aerospace University Shenyang Aerospace University

Shenyang, China Shenyang, China Shenyang, China

26054036@qq.com bensonbb00@163.com zhouhxcool@gmail.com

Abstract —Due to the active defense of benign worms against the

damage imposed by worms, benign worms have been paid

enough attention by network security researchers. This paper

presents patching structured benign worms, and we designed

their deployment and work mechanism. Furthermore, the

process of patching structured benign worms countering against

worms is modeled based on the infectious model. Finally, the

model was simulated. From the simulation, two factors(detection

rate of the sensor and delay time),which affect the process of

patching structured benign worms countering against worms,

were summarized. The model of patching structured benign

worms leads to a better understanding and prediction of the scale

and speed of benign worms countering against the propagation of

worms.

Keywords- network security; malicious code; worm; patching

structured benign worm; worm modeling

I. INTRODUCTION

The Internet has become critically important to the

financial viability of the national and the global economy.

Meanwhile, we are witnessing an upsurge in the incidents of

malicious code in the form of computer viruses and worms.

One class of such malicious code, known as random scanning

worms, spreads itself without human intervention by using a

scanning strategy to find vulnerable hosts to infect. Just like

the Code Red worm

[1-3]

and Slammer worm

[4]

, they can

compromise thousands of hosts in several hours, causing

remarkable disruption to finance, transportation and

government instructions, and precluding any human-based

response.

Since an accurate Internet worm model provides insight

into worm behavior, researchers have modeled the spread of a

virus or worm within a network. S. Staniford etc.

[5]

apply the

simple epidemic model (SEM) to model the spread of worms.

The KM model

[7]

improves the classical simple epidemic

This work is supported by the national natural science

foundation of China under Grant Nos. 61300233, Shenyang

Science and Technology Foundation No. F13-316-1-35 and

the PhD Start-up Fund of National Science Foundation of

Liaoning Province No. 20131086.

model by assuming that some infectious hosts either recover

or die after some time. Zou etc.

[8]

, considering the dynamic

countermeasures and the slowed down worm infection rate,

derive the two-factor model. Besides the epidemiological

model, Chen etc. [9] propose the Analytical Active Worm

Propagation(AAWP) model. There are also some models on

topology worms[10-11]. [12] models the unstructured benign

worm.

This paper presents a mathematical model which

describes the process of patching structure benign worms

countering against worms. Firstly, we analyze the deployment

of patching structured benign worms. Then we derive the

model of patching structured benign worms containing the

spread of worms by the differential equations and simulate the

model. This model of worms can help us understand the

interaction between patching structured benign worms and

worms deeply.

The rest of the paper is organized as follows. Section Ċ

is on related work. Section ċ describes how the patching

structured benign worm contains the spread of worms. We

present the model of patching structured benign worms

countering against worms in section Č . In section č, we

simulate the model with different parameter values and

summarize two important elements. Section Ď concludes the

paper.

II.

RELATED WORK

As mentioned in the section above, deterministic

epidemic models have been used to study worm propagation

[6]. For illustration, consider the two-factor worm model

proposed by Zou et al. [8]:

() ()

()[ () () ()] ()

dI t dR t

t V Rt It Qt It

dt dt

=−−− − (1)

where V is the total number of susceptible hosts on the

Internet, and I(t), R(t), Q(t) represent the number of

infectious hosts, the number of removed hosts from the

infectious population, and the number of removed hosts from

the susceptible population at time t, respectively. The

parameter I(t) is the infection rate at time t and reflects the

impact of the Internet traffic on the worm propagation. The

parameters of I(t) and Q(t) reflect the human countermeasures

in patching.

When there is no patching and the infection rate is

2014 International Conference on Virtual Reality and Visualization

DOI 10.1109/ICVRV.2014.17

236

下载后可阅读完整内容，剩余5页未读，立即下载

weixin_38600341

粉丝: 6
资源: 959

结构化良性蠕虫的主动防御建模与对抗策略

网络蠕虫的结构分析和相关技术研究

论文研究 - 尼日利亚土壤传播的蠕虫感染的空间分布和建模

P2P文件共享网络中被动​​蠕虫传播的建模和分析

渐进式混合蠕虫的建模与分析

多种沉默型P2P蠕虫共同传播的建模与分析

人类流动的时间特征：社会蠕虫传播的建模与分析

结构化对等网中的P2P蠕虫传播模型研究

结构化对等网P2P蠕虫传播模型分析与建模

利用CDC策略的良性蠕虫对抗蠕虫建模与仿真分析

P2P网络中自停止BT蠕虫的动态打击列表建模分析

最新资源

P2P文件共享网络中被动蠕虫传播的建模和分析