Research Of P2P Passive Worm Propagation Model And Pulse Containment Strategy

With the attacking means of the worm to the Internet getting diversified, it is of great importance to pay attention to study the worm propagation. The passive worm, which propagates by the downloading applications on the Internet in a secluded way, has been a major threat to the safety of the Internet. However, the research on passive worm has just been in the initial stage. In the thesis, the propagation of the P2P passive worm will be discussed and the containment will be elaborate in depth.With the development of the importance of Internet Security, researchers have been more and more paid attention to the worm propagation. The worms, which propagate fast and are easily detected, usually search the Internet for vulnerable hosts by random scanning. However, a passive worm has been prevalent due to its elusive. Hence, it is of great importance to study the propagation and containment of the passive worm.According to the characteristic of P2P system and the mechanism of the passive worm, a SEIT propagation model is put forward based on the behavior of the users. Then a basic reproductive rate Ro and the stability of the disease-free equilibrium are acquired by the theoretical derivation of the stability analysis. Based on the theory of SEIT model, a SEIQT model of the passive worm is raised which combines the hybrid intrusion detection system and the quarantine model. Once the misuse detection system find a infected file in a P2P node, a continuous quarantine strategy is used to quarantine the infected host; when the anomalous detection system catch the aggressive behavior, the host, which is detected to be infected, is quarantined by the means of pulsing.In the thesis, the simulation experiment on propagation model and containment model is designed. The result shows that the passive worm could infect quite a number of hosts in P2P network. At the same time, the simulation result also proves the existence of the worm-free equilibrium. Comparing the curves of the propagation model and the containment model, it indicates that the containment model can reduce the threat of the passive worm.