Research on Network-Warning Model Based on Dynamic Peer-to-Peer Overlay Hierarchy

The increasing array of invasions against Internet, which are implemented through the distributed platform fabricated by rapid diffusion of malwares, such as worm and botnet, has become a hotspot of network security research. Traditional network warning models have inefficient infrastructure to integrate widely scattering data and computational resources, leading to incompetence in detecting and preventing Internet-scale threats. In this paper, the notion of “collaborative security” is addressed to be an inevitable approach to resist Internet-scale attacks originated from widely spreading malwares. Therefore, a novel network-warning model based on dynamic peer-to-peer overlay hierarchy has been proposed. The infrastructure of this model has a two-level dynamic P2P overlay hierarchy, which consists of four roles of peers from the top downward and endues the global network defense framework with the ability of self-adaptive adjustment and collaboration across various security domains. As a fundamental characteristic of this model, a compatible XML-based distributed message sharing method is also presented, which effectively integrates the data resources of heterogeneous network security facilities. The result of preliminary experiments based on a proof-of-concept prototype system demonstrates that this model not only carries out alert message aggregation, correlated analysis, attack scenario generation and implementation of active defense mechanism with improved performance and accuracy, but also has prominant robustness, scalability and manageability.