ISSN 1000-1239 CN 11-1777/TP

• 论文 • 上一篇    下一篇

P2P网络中沉默型蠕虫传播建模与分析

冯朝胜1,3 秦志光1 劳伦斯·库珀特2 罗瑞莎·托卡库克2   

  1. 1(电子科技大学计算机科学与工程学院 成都 610054) 2(伦敦大学玛丽皇后学院电子工程系 伦敦 E1 4NS) 3(四川师范大学计算机科学学院 成都 610066) (csfenggy@126.com)
  • 出版日期: 2010-03-15

Reactive Worms Propagation Modeling and Analysis in Peer-to-Peer Networks

Feng Chaosheng1,3 , Qin Zhiguang1, Laurence Cuthbert2, and Laurissa Tokarchuk2   

  1. 1(School of Computer Science & Engineering, University of Electronic Science and Technology of China, Chengdu 610054) 2(Department of the Electronic Engineering, Queen Mary University of London, London, UK E1 4NS) 3(School of Computer Science, Sichuan Normal University, Chengdu 610066)
  • Online: 2010-03-15

摘要: 蠕虫给 Internet 带来巨大威胁,给作为 Internet 覆盖网的P2P网络带来的威胁更大,这主要是由P2P网络本身的特点决定的(就是这些特点为用户带来巨大方便).考虑到威胁P2P网络的3种蠕虫中沉默型蠕虫传播模型还没有被提出(其他2种分别为被动型蠕虫和主动型蠕虫)和沉默型蠕虫的巨大危害性,提出了沉默型蠕虫的传播模型和免疫模型,并基于该模型推导出了沉默型蠕虫不会流行的条件.为了考查各个P2P参数对蠕虫传播的影响和从实践上验证推导出的蠕虫不会流行的条件,使用Matlab进行了大量仿真实验.实验表明,理论推导出的蠕虫不会流行的条件是正确的;实验还进一步表明,蠕虫的流行程度是由流行指数来决定的,这为提出蠕虫控制策略提供了依据.通过对决定流行指数的几个参数的分析表明,在发现蠕虫时迅速降低下载率是补丁发布前控制蠕虫最有效的办法.

关键词: P2P网络, 沉默型蠕虫, 流行指数, 传播建模, 仿真

Abstract: Worms have posed a serious threat to Internet. Meanwhile, worms have posed a more serious threat to P2P networks based on Internet. The key properties of P2P networks, which bring facilities to users, result in vulnerabilities to attacks from P2P worms. Considering that models of the other two P2P worms of three classes of P2P worms,namely passive worms and active worms, have been proposed and reactive worms have seriously threatened P2P networks, the models of propagation and immunization of P2P reactive worms are proposed. Furthermore, the condition of worm free in the stead state is deduced from the model of propagation of reactive worms. In order to validate the epidemic model proposed and the condition of worms free in the steady state, large scale simulation experiments are carried out with the software Matlab. All the simulations validate the model and the necessary conditions. In addition, all the simulations show that it is the prevalent index that is in charge of whether worms are prevalent and the degree of worm spread if it will be prevalent. Obviously, the prevalent index is very helpful to find worm-throttling strategies. Analysis of the P2P-related parameters, which determine the value of the prevalent index, shows that decreasing the download rate is the most effective method of throttling worm spread before the corresponding patches are released.

Key words: P2P networks, reactive worm, prevalent index, modeling worm propagation, simulation