The Propagation Characteristic And CW-A-W Model Research Of Worms

Recently, worm breaks out frequently, and results in tremendous economic destruction, Traditional anti-virus technologies are not applicable to it. Therefore, research on worm becomes a hotspot. But the abilities of worm detection and worm early-warning are limited. Most of current researches are centralized on de-infection and on description of some special worms. The study of worm propagation characteristics and network characteristics are insufficient. This paper makes a comprehensive research on worm propagation characteristics and the network characteristics. A controllable worm-anti-worm idea is put forward, and the resisting propagation model is built up. The models are validated by theory methods and simulation experiments.The works of this paper are listed below.At First, we review the birth and grow of worm, analysis its work mechanisms and point out the shortage of current researches.Secondly, the existing worm propagation models, includes SI Model, KM Model, "Two-Factor" Model and other Model, are discussed and the "two- Factor" Model is improved based on these discussion. We named the improved model "Update-Factor model", which mainly considers the automatic upgrade and large-scale patch programs. We prove that the Update-Factor model matches the worm's post-spreading and can describe the worm's propagation, in which automatic upgrade and large-scale patch programs exist.Thirdly,based on the study of the worm-anti-worm (W-A-W) technique, we put forward the definition of controllable worm, including its distributed framework and work flow. Then, the controllable worm is introduced into worm-anti-worm and "controllable worm anti worm (CW-A-W)" propagation model is built up. Experimental results prove that the traffic produced by anti-worm can be reduced effectively and the anti-worm's state can be controlled easily using the "CW-A-W" model.At last, we simulate "Update-Factor" and "CW-A-W" model with Matlab. The simulation results of "Update-Factor" model match the observed data, Compared with W-A-W mode, "CW-A-W" Model is more effective.