| . Based on distributed system and computer networks, Peer-to-Peer (P2P) is themost popular networking technology for data sharing, instant messaging, andenterprise collaboration. P2P networks have become one part of Internet essentially.However, the current P2P networks are now facing serious security threat since theyalso provide an advantageous facility for worm attacking and propagation. Especiallythe emergence of P2P worms not only brings server harm to P2P networks, but alsoposes an underlying threat to Internet. Therefore, how to defend the P2P worm attacksin dynamic environment has become a significant research topic.According to scanning strategies, Worms can be divided into two categories. oneis scanning worms, the other is non-scanning worms. Scanning worm that found thepotential targets by employing a random scanning strategy occupied a dominantposition in early stages of Internet worm development, but now P2P worms that tend tofind the potential targets by employing neighbor list became mainstream with thedevelopment and popularization of P2P applications. P2P worm is a kind of typicalnon-scannig worm. According to attacking ways, P2P worms that brought much greatthreat to P2P networks security can be divided into three groups. Passive worm,reactive worm and active worm. Passive worms hide themselves in malicious files andtrick users into downloading and executing them for propagation; reactive worms onlypropagate themselves with legitimate network activities; and active worms, they arethe most dangerous non-scannig worm in P2P networks, automatically connect to andinfect the potential targets by using topological information for propagation.As P2P worms can carry out topology propagation by overlay networks, omit thescanning process, which made their propagation more stealthier and their attack moreefficient. It is necessary to establish defense models to exactly describe the defenseprocess of P2P worm, and find a number of key parameters to affect the defensiveperformance of P2P worm by employing these models. This paper makes the followingfour contributions.1) Considering the existing propagation models of active worm in structured P2P system more or less ignored the diversity and dynamic of P2P nodes, a preventionstrategy using node heterogeneous theory is proposed by adjusting the heterogeneousvariable and increasing the configuration differences of adjacent logical nodes instructured P2P network to slow the propagation speed of active worm. Simulationresults show that the spreading speed of active worms in structured P2P network canbe slowed down efficiently by adjusting the heterogeneous variable betweenneighboring nodes.2) Considering the existing defense models of active worm in unstructured P2Psystem are too complex, formalized logic matrix is innovatively put forwarded tocharacterize the propagation of active worm in adversarial environment. Simulationresults show this model is effective and feasible to describe countermeasure processand defense process of active worms in dynamic environment.3) Considering the existing defense models of passive worm more or less ignoredthe impact of the dynamic features of P2P nodes on the spread of worms, such asrandom stir, regular quarantine, sudden traffic and selective execution. A defensemodel of passive worm based on mean-filed theory is proposed to characterize thedefense process of passive worm in dynamic environment. Given the foregoing modelignores the impact of the social attribute of P2P nodes on the spread of worms, such astrust relationship, network topology, security awareness and potential profit. A defensemodel of passive worm based on social network theory is proposed by using creditevaluation system and non-zero-sum game theory．The accuracy and validity of thesedefense models are proved by numerical simulation and simulation experiment.4) Considering the existing defense models of reactive worm more or less ignoredthe impact of the dynamic features of P2P nodes on the spread of worms, a defensemodel of reactive worm is proposed by using mean-filed theory and epidemiologymodel with fully considering various dynamic factors that restrict the propagation ofreactive worm in real environment. Given the foregoing model ignores the impact ofuser behavior on the spread of worms, network size is simulated by analyzingcomparing network size and user behavior at different time periods, and a defensemodel of reactive worm based on dynamic time is proposed by using probabilitytheory. The accuracy and validity of these defense models are proved by numerical simulation and simulation experiment, also the key periods of reactive worm defense isdeduced. |
