Research On Spreading Model And Source Tracing Of Computer Virus

Most existing epidemic models for network viruses are rely on epidemic models for biological viruses, which are not very accurately to describe the real propagation of the modern viruses. The thesis points out network virus have different spreading features compared with biological virus, such as connectivity rate and cure rate are both functions of the time while in biological model the both factors are relatively stable. So computer viruses should have their own spreading models. Based on these dynamic factors the thesis constructs the epidemiological equation for network virus. After working out the solutions to the equation, the paper discusses the deterministic effect of the connectivity rate and the cure rate's variation on the spreading of the virus. Then the thesis compares the results with statistics of some real virus and finds the both fits well.Based on the new model, the thesis focuses on the two key issues of these problems: the epidemic threshold and the individual effect of the virus'spreading. By the analysis of the solution to the new model, the thesis get the conclusion for some viruses, if their spreading depend closely on the connectivity rate and their curing rate are relatively small, then the epidemic thresholds are absent. Thus the thesis gives some explanation to the two open problems of the spreading models for network viruses. Taking the connectivity rate as a basic characteristic, the thesis points out that different node with different connectivity should has different effect in the virus'spreading. The thesis presents the numerical formula to calculate the effect of individual node in the net. Email address relationship between users'address books forms a logical network that is also the basic unit for email viruses to propagate. The thesis points out different email users have different cleaning frequency, different probability of opening stranger attachment and different frequency of sending emails, and it is these three key factors that determine the spreading of email viruses within the email group. Then the thesis defines a communication matrix for the group that includes the three key factors of every email user. Based on the matrix, the thesis constructs a discrete formula to describe the spreading of email viruses in the group. Further more, the thesis studies the die out condition of the email virus in a particular group and mathematically proves that email virus die out if and only if the convergence radius of the matrix of the group must be less than 1.As most papers about net viruses focus the similarity shared by net viruses and biological virus and the source tracing of the latter relies on many uncertain factors, few paper establishes theory on the source tracing of net viruses. Different from those papers, the thesis focus on different spreading features of net virus compared with the biological virus, such as the spreading information of net virus can be recorded. Though tracing the source of virus is the inverse of the viruses'spreading, but the thesis thinks tracing the source is not the strict inverse problem so far. The thesis presents the definition for the source of virus in a sub net: the start vertex of the spreading path of the virus. The thesis points out state changing of the vertices caused by the spreading of the virus is the important hints to tracing the spreading path of the virus, the scanning and cleaning are main methods to get these hints. Then the thesis establishes the source tracing equations for the net virus. Combining with the practice, the thesis presents the main steps and methods to get the solutions to the equations. Working out the equations repeatedly, the thesis gets the source of the virus in the sub net. Finally, the thesis carries out the simulation test on an email group net. The results of the test verify our tracing model and methods of working out the equations. Thus the thesis opens a theoretic way to tracing the source of net viruses.