Worm Simulation Study

Internet worms have severely threatened the security of the network. Because of its suddenness, large scale and great harm, routine Internet research methods don't be the same with the worms. This paper explores the method of worm research by simulation and realizes a worm simulation system based on NS-2.This paper discusses the problems met during worm simulation, which consists of three parts: abstract of the Internet topology, abstract of the worm spread process, and realization of the simulation based on the previous two.(1)Generation of the topology: to generate the AS-level Internet topology including the relationship between ASes by processing data of the BGP routing table. In order to improve the simulation efficiency, an algorithm is proposed to merge the original AS-level topology according to the relationship between ASes, which can ensure the consistency of the relationship and keeping the power law of the network after merging.(2)Spread model: grounded on the SEM model in epidemiology, modifications have been made and a novel worm spread model WSM has been built, which is more suitable for simulation. WSM employs the statistic during simulation instead of the abstract parameter in the original model, so that it can describe the worm behavior precisely and improve the simulation efficiency by simplifying the model.(3)Realization: to realize the worm simulation system WSS by combining the abstract Internet topology with the worm spread model on NS-2. A number of factors which may influence the worm spread are integrated into the system, such as patching system leak, bandwidth restriction, delay, link crash, firewall, and so on. Therefore it is the most comprehensive one among the present worm simulation systems.Comparing experiments prove that WSS can generate data similar to the real worm explosion in the laboratory; hence it will function well for the macro prediction on the worm spread speed, flow, harm, etc. Moreover, WSS can flexibly simulate the spread of unknown worm in various environments by setting different parameters, which helps a lot for worm research and analysis. Finally, it can supply testing case for worm detection and alarm system.