Research On The IM Worm Propagation Model Based On The Second Detection

With the rapid development of the wide application of the network and Instant Messaging (IM)software, IM worms that spreading in the instant messaging network and attacking the loophole ortechnical features of instant messaging system and instant messaging protocol develop rapidly. Internetconnect all around the world, once the worms break out,it will quickly copy resulting the networkparalysis in a large area, at the same time,some worms may bundled Trojan that reside in the user’smachine and read the key information to steal bank account numbers, etc. in great economic losses to theuser. As the rapid development of IM worms, the frequency of enhancement, and the expansion of thescope of attack, the network researchers in security is gradually paying attention to them. Research of IMworms propagation model has important theoretical and practical value.In this paper, the study aiming at the problems of IM worm model is as following:1. Based on the improve of IMWDP (IM worms discrete propagation) model,we put forward theSDWPM model that based on a twice detection of the IM worm propagation model. The IMWDP modelmake the communication of IM worms theoretical for the first time, but this model can not fully reflect theactual spread of IM worms because it only consider two factors on the impact of the worm, the two factorsis user intervention and the number of instant communication user. and the improved IMWDP model onlyimproved in the IM worms propagation later stage, earlier stage dissemination is still not perfect. Aiming atthese problems, we put forward the SDWPM model, a IM worm propagation model that based on thetwice detection, SDWPM model carry out flow detection to the users by using the local gateway, Feed backthe exception information to the server, and the server actualize the second identification by abnormalinformation from the feedback of gateway, so this model can reflect the spread trend of IM worms in realitybetter. The simulation experiment results show that: the SDWPM model reduces the IM worm infectionrate in the process of IM worm propagation, restrains the propagation of IM worms effectively, andimproves the judgment of IM worm success rate obviously through the twice identification.2. We design and implement a prototype system of IM worm propagation model mechanism thatbased on the twice detection, we implement the IM worm propagation model mechanism that based on the twice detection in prototype system, And we test the prototype system and verify the effectiveness of theprototype system.