基于良性益虫的对等网络蠕虫防御技术

Anti-worm Based Defensive Scheme for P2P Worm

对等网络蠕虫利用对等网络的固有特征(如本地路由表、应用层路由等),不仅复制快,而且提供了更好的隐蔽性和传播性,因而其危害大,防御困难。从分析互联网蠕虫及其传播机制入手,对对等网络上的蠕虫(即P2P蠕虫)及其特殊性进行了综合分析。在此基础之上,提出了基于良性益虫的被动激活主动传播防御策略(PAIFDP),并对该策略的技术原理和响应防御系统的功能模块等进行了详细设计。以Peersim仿真平台为基础,对各种不同网络参数下的防御效果和资源消耗情况进行了实验分析。结果表明,基于良性益虫的P2P蠕虫防御技术具有收敛时间快、网络资源消耗少、适应性强等特点。

P2P worms employ the distinctive features of P2P network,such as the local routing table,application routing mechanism and so on,to quickly distribute them into the network while holding the covert characteristic.Contrarily,the common internet worms generally rely on detecting the victims＇ IP address to spread.Therefore,the lack of hidden feature and feasible promulgating paths make that it is easier to detect and defense the ordinary internet worms than P2P worms.Consequently,the P2P worm can do more damage to the network if lacking the effective defensive scheme.In this paper,the P2P worm,especially its transmission mechanism was analyzed synthetically.Then,an anti-worm based scheme for the defensive of P2P worm was presented.The principle and functional modules of this new scheme were addressed as well.By using the Peersim P2P simulator,the performance of our novel scheme was evaluated experimentally in various system parameters.The primary experimental results indicated that our anti-worm based defensive scheme for P2P worm has the features of fast convergence,low overload of networking resource（including communication traffic and computing power）,and high adaptability.