The Research Of Worms Propagation Characteristic By Simulation

The frequent breakouts of Internet worms result in tremendous economic destruction, and worm research has become one of the focuses of information security field gradually. The basic problem of Internet worm research is how to depict the characteristic of worm propagation accurately, which is the foundation of anti-worm research. This dissertation mainly focuses on worm propagation characteristic research using simulation and analytical models methods. The main contents of this dissertation are as follows:Based on the review of the worm definition and Internet worm history, contents of research, motivations and alternatives of worm propagation characteristic research are summarized and a survey is brought up about the mainly progress of this subject.A worm propagation characteristic model is proposed based on the study of the classification of worms, function structure and scan strategies and other related. Using this model, a worm model for simulation is also proposed.Through the analysis of the classic analytical models, an extended version of AAWP model is proposed by extending to routing scan, selective random scan and complete scan from random scan. Using the extended AAWP model, the above three scan strategies are compared.According to the way of network modeling of worm simulators, the existing simulators are classified into three types, which are high-abstracted simulation systems, packet-level simulation systems and large scale distributed simulation systems. This method of classification overcomes the shortcomings of the classical one based on worm modeling, which doesn't distinguish the way of network modeling.GTNetS simulation system is extended in worm modeling, topology generation and simulation scale respectively. These three extensions together make the large scale network simulating with high fidelity possible.Using the extended version of GTNetS, the influence of topology, bandwidth, latency, scan rate of worm (i.e. parallel connection for TCP worms), scan strategies, the size of worms, protocol, infection delay and other factors on worm propagation characteristic are analyzed and remarked by simulation.