An Immunization Strategy for Social Network Worms Based on Network Vertex Influence

Along with the rapid development of social networks, social network worms have constituted one of the major internet security problems. The root of worm is the inevitable software vulnerability during the design and implementation process of software. So it is hard to completely avoid worms in the existing software engineering systems. Due to lots of bandwidth consumption, the patch cannot be transmitted simultaneously by the network administrator to all hosts. This paper studies how to prevent the propagation of social network worms through the immunization of key nodes. Unlike existing containment models for worm propagation, a novel immunization strategy is proposed based on network vertex influence. The strategy selects the critical vertices in the whole network. Then the immunization is applied on the selected vertices to achieve the maximal effect of worm containment with minimal cost. Different algorithms are implemented to select vertices. Simulation experiments are presented to analyze and evaluate the performance of different algorithms.

Modeling and Defending Passive Worms over Unstructured Peer-to-Peer Networks

Passive worms can passively propagate through embedding themselves into some sharing files, which can result in significant damage to unstructured P2P networks. To study the passive worm behaviors, this paper firstly analyzes and obtains the average delay for all peers in the whole transmitting process due to the limitation of network throughput, and then proposes a mathematical model for the propagation of passive worms over the unstructured P2P networks. The model mainly takes the effect of the network throughput into account, and applies a new healthy files dissemination-based defense strategy according to the file popularity which follows the Zipf distribution. The simulation results show that the propagation of passive worms is mainly governed by the number of hops, initially infected files and uninfected files. The larger the number of hops, the more rapidly the passive worms propagate. If the number of the initially infected files is increased by the attackers, the propagation speed of passive worms increases obviously. A larger size of the uninfected file results in a better attack performance. However, the number of files generated by passive worms is not an important factor governing the propagation of passive worms. The effectiveness of healthy files dissemination strategy is verified. This model can provide a guideline in the control of unstructured P2P networks as well as passive worm defense.

MULTI-AGENT SYSTEM FOR WORM DETECTION AND CONTAINMENT IN METROPOLITAN AREA NETWORKS

Active worms can cause widespread damages at so high a speed that effectively precludes human-directed reaction, and patches for the worms are always available after the damages have been caused, which has elevated them self to a first-class security threat to Metropolitan Area Networks (MAN). Multi-agent system for Worm Detection and Containment in MAN (MWDCM) is presented to provide a first-class automatic reaction mechanism that automatically applies containment strategies to block the propagation of the worms and to protect MAN against worm scan that wastes a lot of network bandwidth and crashes the routers. Its user agent is used to detect the known worms. Worm detection agent and worm detection correlation agent use two-stage based decision method to detect unknown worms. They adaptively study the accessing in the whole network and dynamically change the working parameters to detect the unknown worms. MWDCM confines worm infection within a macro-cell or a micro-cell of the metropolitan area networks, the rest of the accesses and hosts continue functioning without disruption. MWDCM integrates Worm Detection System (WDS) and network management system. Reaction measures can be taken by using Simple Network Management Protocol (SNMP) interface to control broadband access server as soon as the WDS detect the active worm. MWDCM is very effective in blocking random scanning worms. Simulation results indicate that high worm infection rate of epidemics can be avoided to a degree by MWDCM blocking the propagation of the worms.

基于贪婪算法的网络通信未知蠕虫检测仿真

网络蠕虫具有智能化和综合网络攻击性,无须计算机使用者干预即可运行的攻击程序或代码,且攻击传播速度较快。计算机防御模型多采用杀毒软件处理蠕虫的检测,但是无法提前防御蠕虫的攻击。因此,提出基于贪婪算法的网络通信未知蠕虫检测方法。通过云安全环境建立蠕虫传播模型,提取未知蠕虫数据特征,采用贪婪算法构建自编码器,降维蠕虫数据特征。利用改进蚁群算法和SVM建立网络攻击检测模型,将降维后蠕虫数据特征输入模型中,完成未知蠕虫的检测。实验结果表明,研究方法的蠕虫检测率更高,且丢包率低于0.5%,主机感染率降低,说明所提方法的应用性能更优。

基于ReliefF算法的通信网络蠕虫病毒高效检测方法

由于传统方法对通信网络蠕虫病毒的检测效果不佳,提出基于ReliefF算法的通信网络蠕虫病毒高效检测方法。首先采用ReliefF算法采集通信网络蠕虫病毒特征,并根据应用程序接口(Application Programming Interface,API)的调用筛选特征;其次将筛选出来的蠕虫病毒特征作为训练样本,将经过特征选择后的训练样本输入分类器中进行模型构建;最后通过交叉验证方法优化模型,并使用构建的模型检测文件中是否含有蠕虫病毒。实验结果表明,采用基于ReliefF算法的通信网络蠕虫病毒检测方法准确率较高,且优于其他两种方法。

Simulating Greedy Propagation of P2P Worms

Greedy propagation policy for unstructured P2P worms employs the neighboring node list of each node in peer-to-peer （P2P） network to speed up the propagation of P2P worms. After describing the technique background of P2P worms, the algorithm of greedy propagation is addressed. Simulating design for this novel propagation policy is also described. Then, the effects of the greedy propagation policy on spreading speed, convergence speed, and attacking traffic in static P2P worms are simulated and discussed. The primary experimental results show that the greedy propagation is harmful and can bring severe damages to P2P network.

Information Theory and Data-Mining Techniques for Network Traffic Profiling for Intrusion Detection

In this paper, information theory and data mining techniques to extract knowledge of network traffic behavior for packet-level and flow-level are proposed, which can be applied for traffic profiling in intrusion detection systems. The empirical analysis of our profiles through the rate of remaining features at the packet-level, as well as the three-dimensional spaces of entropy at the flow-level, provide a fast detection of intrusions caused by port scanning and worm attacks.

Modeling and analysis of gradual hybrid anti-worm

The gradual hybrid anti-worm (GHAW) was presented. It changed its confrontation scheme in real time according to the percentage of vulnerable hosts present in the network. For GHAW, its process of countering malicious internet worms was modeled. The performance of GHAW on two factors was also estimated: confronting validity against worms and consumption of network resources. Factors governing its performance, specifically the transformation threshold and the transformation rate, were analyzed. The simulation experiments show that GHAW has dynamical adaptability to changes of network conditions and offers the same level of effectiveness on confronting internet worms as the divide-and-rule hybrid anti-worm, with significantly less cost to network resources. The experiments also indicate that the transformation threshold is the key factor affecting the performance of GHAW.

Research on the Propagation Models and Defense Techniques of Internet Worms

Internet worm is harmful to network security,and it has become a research hotspot in recent years.A thorough survey on the propagation models and defense techniques of Internet worm is made in this paper.We first give its strict definition and discuss the working mechanism.We then analyze and compare some repre-sentative worm propagation models proposed in recent years,such as K-M model,two-factor model,worm-anti-worm model（WAW）,firewall-based model,quarantine-based model and hybrid benign worm-based model,etc.Some typical defense techniques such as virtual honeypot,active worm prevention and agent-oriented worm defense,etc.,are also discussed.The future direction of the worm defense system is pointed out.

Grid-based internet worm behavior simulator

The traditional network simulator has function and performance limitation when simulating Internet worms,so we designed the grid-based Internet worm behavior simulator (IWBS Grid).IWBS Grid makes use of the real Internet topology,link and routing information,and simulates the worm behavior at the packet event-driven level;and proposes a high-performance Internet worms behavior simulation platform by right of the grid computing capability,resource and task management,and so on.The experimental results show that IWBS grid surpasses the traditional simulator in simulating capability,and the technology to track the worm propagation in packet level can propose the valuable information for the further study on worms.

具有饱和发生率的网络蠕虫病毒模型分析

该文研究了一类具有饱和发生率的网络蠕虫病毒的VEIQS模型,此模型考虑了疫苗接种策略和隔离控制策略.通过计算得到了病毒能否被控制的阈值R 0,论证了平衡点的存在性与稳定性.当R 0<1时,利用构造Lyapunov函数的方法得到了无病平衡点P 0是全局渐近稳定的,病毒传播得到了有效控制;当R 0>1时,利用Li-Muldowney几何准则得到了地方病平衡点P*是全局渐近稳定的,病毒仍然存在.最后,对理论结果做了数值仿真并通过敏感性分析探究了各参数与阈值R 0之间的关系.

基于MapReduce的大规模在线社交网络蠕虫仿真

利用云计算中的核心技术MapReduce,提出了一种在线社交网络(online social network,简称OSN)蠕虫的仿真方法.为了提高仿真精度,首先提出利用节点属性可调节的OSN有向图来描述蠕虫传播的各个过程.其次,利用运行在云环境中的多个Map函数和Reduce函数来实现对OSN蠕虫传播各个过程的仿真.在真实的大规模数据集上的仿真实验结果表明,提出的仿真方法不仅具有较强的可扩展性,同时也为相关领域的研究提供了一定的帮助.

社交网络蠕虫仿真建模研究

随着互联网虚拟社交网络的发展,借助网络用户进行传播的社交网络蠕虫已经成为威胁网络安全的重大隐患之一.文中从社会工程学的角度研究社交网络蠕虫的传播机制,通过量化影响用户行为的若干因素,提出了微观节点上的基于用户安全意识的行为博弈模型;通过分析网络用户活动的习惯特性,构建了宏观网络上离散的基于用户习惯的社交网络访问模型;从而实现了一个适用于社交网络蠕虫传播研究的仿真系统.实验分析了模型中用户相关因素对蠕虫传播的影响,验证了仿真系统的有效性.最后,利用该系统仿真了社交网络蠕虫在异质社交网络中的传播,揭示了网络拓扑结构和社交网络混杂程度对蠕虫传播的影响,为社交网络蠕虫相关研究提供了重要支持.

一种基于邻居信任评估的虫洞防御机制

移动ad hoc网是一种新型无线移动网络,具有无中心、自组织、拓扑结构变化频繁以及开放式通讯信道等特性,因此ad hoc网络下的路由协议所面临的安全问题比有线网环境中更为严重。虫洞攻击就是其中的一种,能够对ad hoc网络产生致命的影响。在这种攻击下,网络的路由机制将会紊乱,特别是那些依赖通过接收对方的广播报文进行邻居探测的路由协议。本文首先从虫洞形成的根源上入手,重新定义了邻居的概念,强调了邻居作为节点信息转发第一站的功能。然后根据邻居定义,引入简化的Marsh1信任模型,将邻居的以往表现作为信任评估的经验来源,再通过具体公式对邻居关系做出判定。在具体的路由过程中,节点根据信任评估值选取高可信度的邻居作为下一跳的转发节点,从而避免虫洞攻击的危害。为了验证方法的可行性,本文将模型应用于OLSR路由协议中并在NS2中进行了仿真。

XSS蠕虫在社交网络中的传播分析

通过分析社交网络的特点,将节点分为活跃节点和非活跃节点。针对XSS蠕虫的传播,分析其传播受到的影响因素,建立数学模型。仿真结果表明,节点访问偏向度对XSS蠕虫传播影响较小,而XSS蠕虫采用社会工程学的熟练度及节点安全意识,对XSS蠕虫传播影响较大。活跃节点的安全意识较大程度影响了XSS蠕虫传播效率,将活跃节点作为防御点和监控点的防御策略切实可行。

基于蠕虫特征的校园网防御体系

随着Code Red,Slammer,冲击波,Sasser等网络蠕虫的相继大规模爆发,其影响和危害也波及我国高校的校园网．以网络蠕虫的生命周期的各个阶段特征出发,并在此基础上提出一种安全的校园网防御体系结构,来防止、防御蠕虫的传播和破坏,以保障校园网络安全正常稳定地运行．

无线传感器网络蠕虫的传播与控制

研究基于IEEE 802.15.4协议的无线传感器网络蠕虫传播方法,并根据IEEE802.15.4的固有特性,提出了网络环境自适应的节点免疫算法,算法通过本地及邻居信息选择免疫节点控制蠕虫的传播.针对提出的算法存在免疫过程容易陷入局部度风险最大点的问题,借鉴模拟退火算法的基本原理,提出了改进的自适应免疫算法.仿真实验表明,本文提出的算法可以通过免疫少量的节点有效的抑制蠕虫的扩散,提高了无线传感器网络抵抗蠕虫攻击的能力.