蠕虫扫描策略和流量模拟方法研究  

Research of worm scanning strategies and worm traffic simulation method

作　　者：陈利[1] 潘正清[1] 向郑涛[1] 陈宇峰[1] 

机构地区：[1]湖北汽车工业学院计算中心,湖北十堰442002

出　　处：《计算机工程与设计》2007年第7期1528-1531,共4页Computer Engineering and Design

基　　金：湖北省自然科学基金项目(2006ABA039);湖北省教育厅科学基金项目(D200623002;B200623001)。

摘　　要：对蠕虫扫描策略及其传播效率进行了深入分析;并提出了“带宽限制型+部分预定义目标地址列表+基于路由扫描+随机均匀扫描”的快速扫描策略。分析了各种蠕虫传播过程模拟方法和蠕虫流量模拟方法的优劣;并从统计意义上建立了“延迟限制型”蠕虫的周期性突发的扫描流量模型,结合混合层次模拟方法,能够为蠕虫模拟、检测和应对技术提供基础,同时减少了蠕虫模拟的复杂性。The scanning strategies of worms and the propagation speed are analyzed. A quickly scanning strategy is proposed, which combines bandwidth-limited and hit-list and routable and randomly scanning strategies. The advantages and disadvantages of various worm simulation methods are interpreted involving the simulation of worm propagation and worm traffic. The periodic and burst scanning trattic model for ＂latency-limited＂ worm is proposed statistically. Combined with the mixed abstraction level worm simulation method, the trattic model provide the basis for worm simulation, detection and response, and at the same time, reduce the complexity of worm simulation.

关 键 词：蠕虫扫描 蠕虫模拟 传播效率 周期性突发模型 混合层次模拟 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构] TP393.08[自动化与计算机技术—计算机科学与技术]