基于马尔可夫链的网络蠕虫传播模型

doi:10.11959/j.issn.1000-436x.2015111

通信学报 ›› 2015, Vol. 36 ›› Issue (5): 66-71.doi: 10.11959/j.issn.1000-436x.2015111

基于马尔可夫链的网络蠕虫传播模型

周翰逊¹,郭薇²,刘建¹,贾大宇³

¹ 辽宁大学信息学院，辽宁沈阳 100036
² 沈阳航空航天大学计算机学院，辽宁沈阳 110136
³ 东北大学信息科学与工程学院，辽宁沈阳 110819

出版日期:2015-05-20 发布日期:2015-07-17
基金资助:
国家自然科学基金资助项目;国家自然科学基金资助项目;辽宁省博士启动基金资助项目;沈阳市科技计划基金资助项目;辽宁省交通科技基金资助项目

Internet worm propagation model based on Markov chain

HOUHan-xun Z¹,UOWei G²,IUJian L¹,IADa-yu J³

¹ School of Information Science,Liaoning University,Shenyang 100036,China
² School of Computer,Shenyang Aerospace University,Shenyang 110136,China
³ School of Information Science and Engineering,Northeastern University,Shenyang 110819,China

Online:2015-05-20 Published:2015-07-17
Supported by:
The Transportation Technology Project of Liaoning Province;The Transportation Technology Project of Liaoning Province;The Transportation Technology Project of Liaoning Province;The Transportation Technology Project of Liaoning Province;The Transportation Technology Project of Liaoning Province

摘要/Abstract

摘要：

提出了网络蠕虫的随机传播模型。首先，基于马尔可夫链对于网络蠕虫进行了建模，并且讨论了模型的极限分布以及平稳分布的存在性。然后，讨论了网络蠕虫在传播初期灭绝的充要条件以及在传播后期灭绝的必要条件。最后，讨论了网络蠕虫的传播规模。仿真实验对于模型进行了验证，讨论了模型中传播参数，时间参数以及漏洞主机数等相关参数对于网络蠕虫传播的影响，并且与G-W模型进行了数据对比，说明了本模型的优势。

关键词: 网络安全, 蠕虫, 马尔可夫链, 蠕虫的随机模型

Abstract:

A stochastic model of Internet worms is presented.Firstly,the propagation of worms is modeled based on Markov chain.The limit distribution and invariant distribution of the model is discussed.Then,necessary and sufficient conditions of the worm propagation in the initial stage and sufficient conditions of the worm propagation in the late stage are discussed.Finally,the scale of the worm propagation is discussed.The simulation validates the model.And the effect of propagation,time and vulnerable host parameter on the spread of worms is discussed.Furthermore,it is compared to the G-W model,and the advantage of it is illustrated.

Key words: network security, worm, Markov chain, stochastic model of Internet worms

周翰逊,郭薇,刘建,贾大宇. 基于马尔可夫链的网络蠕虫传播模型[J]. 通信学报, 2015, 36(5): 66-71.

HOUHan-xun Z,UOWei G,IUJian L,IADa-yu J. Internet worm propagation model based on Markov chain[J]. Journal on Communications, 2015, 36(5): 66-71.

图/表 5

参考文献 18

[1]	SPAFFORD E H . The Internet Worm Program:an Analysis[R]. Technical Report,CSD-TR-823,West Lafayette:Department of Computer Science,Purdue University, 1988. 1-29.
[2]	MOORE D , SHANNON C , BROWN J . Code-Red:a case study on the spread and victims of an Internet worm[A]. Proceedings of the Second ACM SIGCOMM Workshop on Internet Measurement[C]. 2002. 273-284.
[3]	刘玉岭，冯登国，吴丽辉等．基于静态贝叶斯博弈的蠕虫攻防策略绩效评估[J]．软件学报， 2012,23(3):712-723. LIU Y L , FENG D G , WU L H , et al. Performance evaluation of worm attack and defense strategies based on static Bayesian game[J]. Journal of Software, 2012,23(3):712-723.
[4]	汪洁，王建新，刘绪崇．基于近邻关系特征的多态蠕虫防御方法[J]．通信学报， 2011,32(8):150-158. WANG J , WANG J X , LIU X C . Novel approach based on neighborhood relation signature against polymorphic internet worms[J]. Journal on Communications, 2011,32(8):150-158.
[5]	洪征，吴礼发．基于阳性选择的蠕虫检测系统[J]．软件学报， 2010,21(4):816-826. HONG Z , WU L F . Worm detection system based on positive selection[J]. Journal of Software, 2010,21(4):816-826.
[6]	唐勇，诸葛建伟，陈曙晖等．蠕虫正则表达式特征自动提取技术研究[J]．通信学报， 2013,34(3):141-147. TANG Y , ZHUGE J W , CHEN S H , et al. Automatic generating regular expression signatures for real network worms[J]. Journal on Communications, 2013,34(3):141-147.
[7]	STANIFORD S , PAXSON V , WEAVER N . How to own the Internet in your spare time[A]. Proc of the 11th Usenix Security Symp[C]. San Francisco, 2002.
[8]	ZOU C C , GONG W , TOWSLEY D . Code Red worm propagation modeling and analysis[A]. Proc of the 9th ACM Symp.on Computer and Communication Security[C]. 2002. 138-147.
[9]	CHEN Z , GAO L , KWIAT K . Modeling the spread of active worms[A]. IEEE INFOCOM 2003[C]. 2002. 1890-1900.
[10]	YU W , WANG X , PRASAD C , ZHAO W . Modeling and detection of Camouflaging worm[J]. IEEE Transaction on Dependable and Secure Computing, 2011,8(4): 377-390.
[11]	冯朝胜，秦志光，袁丁等． P2P 网络中被动型蠕虫传播与免疫建模[J]．电子学报， 2013,41(5):884-889. FENG C S , QIN Z G , YUAN D , et al. Modeling propagation and immunization of passive worms in peer-to-peer networks[J]. Acta Electronica Sinica, 2013,41(5):884-889.
[12]	孙鑫，刘衍珩，朱建启等．社交网络蠕虫仿真建模研究[J]．计算机学报， 2011,34(7):1252-1261. SUN X , LIU Y H , ZHU J Q , et al. Research on simulation and modeling of social network worm propagation[J]. Chinese Journal of Computers, 2011,34(7):1252-1261.
[13]	YU W , ZHANG N , FU X W , et al. Self-disciplinary worms and countermeasures:modeling and analysis[J]. IEEE Transactions on Parallel and Distributed Systems, 2010,21(10):1501-1514.
[14]	张伟，王汝传，李鹏．基于云安全环境的蠕虫传播模型[J]．通信学报， 2012,33(4):17-24. ZHANG W , WANG R C , LI P . Worm propagation modeling in cloud security[J]. Journal on Communications, 2012,33(4):17-24.
[15]	JENNIFER T . Jackson and sadie creese,virus propagation in heterogeneous bluetooth networks with human behaviors[J]. IEEE Transactions on Dependable and Secure Computing, 2012,9(6): 930-943.
[16]	刘烃，郑庆华，管晓宏等．基于随机实验的蠕虫传播预测研究[J]．通信学报， 2007,28(12):72-77. LIU J , ZHENG Q H , GUAN X H , et al. Research of worm-propagation prediction based on stochastic experiment[J]. Journal on Communications, 2007,28(12):72-77.
[17]	SARAH S , NESS B S , SAURABH B . Modeling and automated containment of worms[J]. IEEE Transactions on Dependable and Secure Computing, 2008,5(2): 528-537.
[18]	ROSS S . Stochastic Processes[M]. John Wiley ＆ Sons, 1996

符号	说明
N	蠕虫可以感染的漏洞主机
β	蠕虫的感染率
γ	蠕虫的移去率
t	时间t
p_ij(t)	t时刻网络蠕虫传播从i状态到j状态的概率
I(i)	处于感染状态的主机数目

基于马尔可夫链的网络蠕虫传播模型

Internet worm propagation model based on Markov chain

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 5

参考文献 18

相关文章 15

Metrics

推荐阅读 0

[1]	赵仕祺, 黄小红, 钟志港. 基于信誉的域间路由选择机制的研究与实现[J]. 通信学报, 2023, 44(6): 47-56.
[2]	谢人超, 文雯, 唐琴琴, 刘云龙, 谢高畅, 黄韬. 轨道交通移动边缘计算网络安全综述[J]. 通信学报, 2023, 44(4): 201-215.
[3]	徐明, 张保俊, 伍益明, 应晨铎, 郑宁. 面向网络攻击和隐私保护的多智能体系统分布式共识算法[J]. 通信学报, 2023, 44(3): 117-127.
[4]	康海燕, 龙墨澜. 基于吸收马尔可夫链攻击图的网络攻击分析方法研究[J]. 通信学报, 2023, 44(2): 122-135.
[5]	郭渊博, 李勇飞, 陈庆礼, 方晨, 胡阳阳. 融合Focal Loss的网络威胁情报实体抽取[J]. 通信学报, 2022, 43(7): 85-92.
[6]	佘维, 荣欣鹏, 刘炜, 田钊. 基于马尔可夫链的生成式区块链隐蔽通信模型[J]. 通信学报, 2022, 43(10): 121-132.
[7]	张红斌, 尹彦, 赵冬梅, 刘滨. 基于威胁情报的网络安全态势感知模型[J]. 通信学报, 2021, 42(6): 182-194.
[8]	张腾飞, 余顺争. 移动设备加密流量的用户信息探测研究展望[J]. 通信学报, 2021, 42(2): 154-167.
[9]	程旭, 王莹莹, 张年杰, 付章杰, 陈北京, 赵国英. 基于空间感知的多级损失目标跟踪对抗攻击方法[J]. 通信学报, 2021, 42(11): 242-254.
[10]	黄韬, 刘江, 汪硕, 张晨, 刘韵洁. 未来网络技术与发展趋势综述[J]. 通信学报, 2021, 42(1): 130-150.
[11]	罗智勇,杨旭,刘嘉辉,许瑞. 基于贝叶斯攻击图的网络入侵意图分析模型[J]. 通信学报, 2020, 41(9): 160-169.
[12]	吴武飞,李仁发,曾刚,谢勇,谢国琪. 智能网联车网络安全研究综述[J]. 通信学报, 2020, 41(6): 161-174.
[13]	李涛,郭渊博,琚安康. 融合对抗主动学习的网络安全知识三元组抽取[J]. 通信学报, 2020, 41(10): 80-91.
[14]	周翰逊,陈晨,冯润泽,熊俊坤,潘宏,郭薇. 基于值导数GRU的移动恶意软件流量检测方法[J]. 通信学报, 2020, 41(1): 102-113.
[15]	蒋侣,张恒巍,王晋东. 基于信号博弈的移动目标防御最优策略选取方法[J]. 通信学报, 2019, 40(6): 128-137.