Research On Internet Worm Propagation Models

With the explosive growth of network and popularity of its applications, the system or management loopholes are looming large. Therefore malicious code like worms cause a lot more damage to network infrastructure and application. The worm propagation model is a mathematical description of worm propagation behavior, and it is instructional to a further study of worm detection and inhibition technology. After an analysis of worm characteristics in scanning and an elaborate study of different kinds of typical worm propagation models, TR-AAWP and IR-AAWP models are proposed on the basis of AAWP (Analytical Active Worm Propagation) model and further on an improved AAWP model is set up by combining the previous two, so as to describe the worm propagation more accurately and dynamically. The main research is done as follows:1. An in-depth analysis and research are made of some mainstream worm propagation models, on the ground of which doubt is raised as to whether the total of vulnerable hosts is a constant. Some defects of AAWP model are further illustrated.2. Based on the modeling that vulnerable-host total changes with time, with the situation in China as a case study, AAWP model relevant to propagation time (TR-AAWP) is proposed.3. After the study of worm infection time, AAWP model relevant to infection time (IR-AAWP) was presented.4. The improved AAWP model is presented, which combined TR-AAWP model and IR-AAWP model, solved two potential problems of AAWP model: it cannot reflect the changing number of vulnerable hosts; it cannot reflect the time needed to completely infect a host. The Code Red v2 worm propagation with the data collected from Internet usage in China is simulated by using NWS. The experiments prove that this new model is effective.