【作者】 张宏琳；

【导师】 王小明；

【作者基本信息】 陕西师范大学 ， 计算机软件与理论， 2007， 硕士

【摘要】 随着互联网应用的普及，网络蠕虫对计算机系统安全和网络安全的威胁日益增加，给社会经济带来了巨大损失，网络蠕虫已经成为当今网络安全领域研究的重要课题。网络蠕虫传播模型是分析和预防网络蠕虫的理论基础，但现有的网络蠕虫传播模型却忽略了网络蠕虫传播过程中许多细节因素的影响。随着网络系统变得越来越复杂，使得网络蠕虫传播系统成为一个非线性、动态反馈的复杂系统。系统动力学理论和方法十分适用于研究具有高阶次、非线性和多回路特点的复杂系统，因此本文利用系统动力学理论和方法来研究复杂的网络蠕虫传播系统是一种新的思路，对网络蠕虫传播模型的研究具有一定的指导意义。在网络蠕虫对抗方面，利用良性蠕虫主动对抗网络恶性蠕虫是一个非常有效的方法，但是现有的利用良性蠕虫对抗网络蠕虫的模型却忽略了良性蠕虫本身的传播与其他限制因素的关系。由于生物免疫系统是一个具有高度分布性和很强的自学习能力的系统，能主动发现并迅速消灭外来病毒，网络蠕虫免疫系统则用来保护计算机网络免受网络蠕虫的攻击，二者在功能上具有很多相似性。因此本文通过借鉴生物免疫思想，在提出了成熟良性蠕虫、记忆良性蠕虫和疫苗良性蠕虫这三种良性蠕虫新概念的基础上，建立了新的网络蠕虫免疫模型。因此本文基于系统动力学理论和方法，深入研究网络蠕虫传播过程的复杂影响因素，提出一个新的网络蠕虫传播模型(NWPM模型)，并且借鉴生物免疫原理建立一个网络蠕虫免疫模型(IWIM模型)。借鉴生物免疫思想并利用多种良性蠕虫作为智能对抗主体来对抗日益复杂多变的网络恶意蠕虫，为抑制网络蠕虫的传播提供了一种新的思路，有一定的参考价值。(1)对网络蠕虫传播机制进行深入分析，提出了网络蠕虫潜伏期新概念，建立了新的主机状态转移关系，运用系统动力学理论和方法，建立了一种新的网络蠕虫传播模型，深入刻画网络蠕虫快速传播阶段的网络特性，为动态防治网络蠕虫传播提供了新的理论依据。(2)利用系统动力学软件Vensim模拟了一种新的网络蠕虫传播模型。根据三次网络蠕虫爆发的数据，对该模型分别进行模拟。通过仿真试验，从定性和定量两方面分析和预测网络蠕虫传播趋势，并对影响网络蠕虫传播过程的重要因素进行了分析讨论。(3)在NWPM模型的基础上，基于生物免疫原理提出了成熟良性蠕虫、记忆良性蠕虫和疫苗良性蠕虫三种良性蠕虫的新概念，然后运用系统动力学方法建立了IWIM模型，为动态主动防治网络蠕虫传播提供了新的思路。(4)利用系统动力学软件Vensim模拟了IWIM模型，分别考虑了三种良性蠕虫不会自行销亡、三种良性蠕虫自行销亡、三种良性蠕虫存在性三种不同情况，分析和预测网络蠕虫免疫过程。通过大量的实验仿真，研究了三种良性蠕虫与恶性蠕虫交互过程中，其对恶性蠕虫传播过程的影响，为动态防治网络蠕虫传播提供了有价值的数据以及指导方案。更多还原

【Abstract】 With the popularization of Internet application, threats of Internet worm is increasing in the computer system security and network security. It has caused great losses to the society and economy, so Internet worm research has become an important topic in the field of network security.Internet worm propagation model is the theoretical basis of analyzing and preventing Internet worm. However, in the existing Internet worm propagation models, many specific factors have been neglected, which influence the process of Internet worm propagation. With the Internet system becoming more and more complex, Internet worm propagation system has become a nonlinear complex dynamic feedback system. System dynamics theory and methods are adapted to describing the characteristics of higher-order, non-linear and multi-loop complex systems. So it is a novel idea to study the Internet worm propagation system by using system dynamics theory and methods, and it has some guiding significances to the study of novel Internet worm propagation model.In the aspect of defending Internet worm, it is a very effective way to defend vicious worm actively by using friendly worm. However, the existing models of defending Internet worm by using friendly worm neglect of the relations between friendly worms and other constraints. Because the biological immune system is a highly distributed and strong self-learning system, which can discover and kill the foreign viruses actively and rapidly, while Internet worm immune system is used to protect computer networks from Internet worm attacking, they have many similarities in functions. So, in this paper, the novel concepts of mature friendly worm, memory friendly worm and bacterin friendly worm are presented according to the idea of biology immune, and a novel Internet worm immune model is built based on the novel concepts above.Based on system dynamics theory and methods in this paper, the complex influencing factors are studied deeply in the process of Internet worm propagation, a novel Internet worm propagation model(NWPM) is built, and a novel Internet worm immune model(IWIM) is built based on biological immune principle. According to the idea of biology immune and using a variety of friendly worms as the intelligent confronting agents to defend increasingly complex and ever-changing Internet vicious worms, a novel idea is proposed and it has some reference values for defending Internet worm propagation.(1) By analyzing deeply Internet worm propagation mechanism, the novel concept of latent period of Internet worm is proposed, and the new transition relations of hosts’ states are built. Based on system dynamics theory and methods, a novel Internet worm propagation model is proposed, and it can depict deeply the characteristics of rapid propagation of Internet worm. As a result, a novel theoretical basis is built for preventing the propagation of Internet worm dynamically.(2) The novel Internet worm propagation model is simulated by using system dynamics software Vensim. According to the data of the three Internet worm outbreaks, the model is simulated respectively. Through the simulation experiments, the trend of Internet worm propagation may be analyzed and forecast from two aspects of quality and quantity. And also the important factors of influencing the process of Internet worm propagation are analyzed and discussed.(3) Based on NWPM model and the biological immune principle, three novel concepts of mature friendly worm, memory friendly worm and bacterin friendly worm are proposed. Then IWIM model is built by using system dynamics methods. So a new idea is proposed for defending the propagation of Internet worm dynamically.(4) IWIM model is simulated by using system dynamics software Vensim. In this model, Internet worm immune process is analyzed and forecast by considering three different cases, the three friendly worms can’t vanish, the three friendly worms can vanish and whether the three friendly worms exist or not. Through a large number of simulation experiments, the influence of the three friendly worms to the process of vicious worms propagation is researched in interactive process of three friendly worms with vicious worms. So the valuable data and instructions are provided for defending the propagation of Internet worm dynamically.更多还原