基于随机实验的蠕虫传播预测研究

Research of worm-propagation prediction based on stochastic experiment

蠕虫传播预测是蠕虫防御的基础之一,但随着蠕虫扫描策略日趋多样和互联网结构逐步复杂,在蠕虫爆发初期及时建立精确的蠕虫传播模型变得越来越困难。利用随机仿真实验来模拟蠕虫在网络中的传播行为,通过统计分析仿真实验结果,发现蠕虫传播实验结果是一个随机过程,而实验结果间存在很高的线性相关性。由此提出一种基于仿真实验统计结果的蠕虫传播趋势预测方法,该方法可以利用0.1%存在漏洞主机的感染信息精确的预测蠕虫传播趋势。

The prediction of the worm propagation is the basis of the worm defense. It is becoming more difficult to model the propagation of worms in the early stage of worm-spreading, because the worm strategies are smarter and the Internet structure is more complicated than ever before. In present study, a stochastic simulator was designed to simulate the propagation of worms. From the analysis of 1000 groups of experiment results, it was proved that the worm-propagation is a stochastic process, and the correlation coefficient between each group of results is close to 1. Therefore, a new prediction method was proposed, which could accurately calculate the propagation of worm when 0. 1% of all vulnerable hosts were infected.