【作者】 刘烃； 郑庆华； 管晓宏； 屈宇； 陈欣琦；

【Author】 Liu Ting Zheng Qinhua Guan Xiaohong Qu Yu Chen Xinqi (Ministry of Education Key Lab for Intelligent Network and Network Security,Xi’an Jiaotong University,Xi’an 710049)

【机构】 西安交通大学智能网络与网络安全教育部重点实验室；

【摘要】 对蠕虫传播的预测是蠕虫防御的基础之一,但随着蠕虫扫描策略日趋多样和互联网结构逐步复杂, 在蠕虫爆发初期及时建立精确的蠕虫传播模型变得越来越困难。本研究中利用随机仿真实验来模拟蠕虫在网络中的传播行为,通过对大量仿真实验结果的统计分析,发现了蠕虫传播实验结果是一个随机过程,同时这些实验结果间存在很高的线性相关性。由此本文提出了一种基于仿真实验统计结果的蠕虫传播趋势预测算法,该算法可以利用0．1%存在漏洞主机的感染信息精确的预测蠕虫传播趋势。更多还原

【Abstract】 The prediction of the worm propagation is the basis of the worm defense.It is becoming more difficult to model the propagation of worms in the early stage of worm-spreading, because the worm strategies are smarter and the Internet structure is more complicated than ever before.In present study, a stochastic simulator was designed to simulate the propagation of worms.From the analysis of 1000 groups of experiment results, it was proved that the worm-propagation is a stochastic process, and the correlation coefficient between each group of results is close to I.Therefore, a new prediction method was proposed, which could accurately calculate the propagation of worm when 0.1% of all vulnerable hosts were infected.更多还原