IPv6网络中蠕虫传播模型及分析  

Modeling and Analysis of Worm Propagation in IPv6 Networks

作　　者：刘烃[1,2] 郑庆华[1,2] 管晓宏[1,2] 陈欣琦[1,2] 蔡忠闽[1,2] 

机构地区：[1]西安交通大学机械制造系统工程国家重点实验室 [2]西安交通大学智能网络与网络安全教育部重点实验室西安710049

出　　处：《计算机学报》2006年第8期1337-1345,共9页Chinese Journal of Computers

基　　金：国家自然科学基金(60243001;60574087);国家"八六三"高技术研究发展计划项目基金(2003AA142060);国家杰出青年科学基金(6970025)资助.

摘　　要：IPv6网络由于其巨大的地址空间,通常被认为对随机扫描蠕虫有天然的抵御能力,该文研究了一种可以在IPv6网络中迅速传播的新型网络蠕虫(V6-Worm).基于对V6-Worm扫描策略的分析,分别建立简单传染病模型和双因素蠕虫模型来仿真V6-Worm的传播趋势.简单传染病模型的仿真结果证明,V6-Worm拥有比随机扫描蠕虫更快的传播速度;双因素蠕虫模型的仿真结果证明,V6-Worm拥有更强的对抗蠕虫控制措施的能力,同时在研究中发现主机中存在漏洞的比例是V6-Worm传播性能的主要影响因素.最后,文中从防止地址信息泄漏和降低主机存在漏洞比例两个角度,讨论了V6-Worm的防御策略.It is a common belief that IPv6 could defend against random-scanning worms due to its huge address space. However, a new type of worm, V6-Worm, possibly propagating in IPv6 network rapidly, is presented in this paper. Based on the analysis of the scanning strategy of V6-Worm, two models——Simple Epidemic Model （SEM） and Two-Factor Model （TFM） are established for simulating the propagation of V6-Worm. The simulation results of SEM show that V6-Worm can propagate more rapidly in the IPv6 network than the random-scanning worm in the current IPv4 network. Furthermore the simulation results of TFM show that V6-Worm can counter the worm defense strategies better than the random-scanning worms. The results also indicate that the percentage of vulnerable hosts is the key factor affecting V6-Worm＇s propagating capability. Some defense strategies are discussed focusing on preventing address leakage and reducing the percentage of vulnerable hosts.

关 键 词：IPV6 网络蠕虫 蠕虫扫描策略 蠕虫传播模型 蠕虫防御策略 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]