基于用户行为和网络拓扑的Email蠕虫传播  

Email-worm propagation with user behavior and network topology

作　　者：刘衍珩[1,2] 孙鑫[1,2] 王健[1,2] 李伟平[3] 朱建启[1,2] 

机构地区：[1]吉林大学计算机科学与技术学院,长春130012 [2]吉林大学符号计算与知识工程教育部重点实验室,长春130012 [3]长春吉大正元信息技术股份有限公司,长春130012

出　　处：《吉林大学学报（工学版）》2010年第6期1655-1662,共8页Journal of Jilin University:Engineering and Technology Edition

基　　金：国家自然科学基金项目(60973136);国家科技部国际合作与交流专项项目(2008DFA12140);'十一五'国家科技支撑计划项目(2008BAH22B02);吉林大学'985工程'研究生创新基金项目(20080235)

摘　　要：通过分析用户行为规律和电子邮件网络拓扑特征,提出了能够准确描述Email蠕虫传播特性的仿真算法。首先,基于Enron Email数据集构建了能够表征Email网络特点的仿真环境,实验结果验证了仿真算法能够准确地体现Email蠕虫传播特性。然后从理论和实验两方面分析验证了关键节点被感染后会加速蠕虫的传播的结论,并讨论了不同防护措施对蠕虫传播的抑制效果。最后建立了Email蠕虫传播数学解析模型(Topo-SIS),与仿真结果的比较表明,该模型能够较好地预测Email蠕虫的传播规模。By introducing the effects of user behavior and network topology,a novel email-worm propagation simulation algorithm is presented.Also a practical simulation environment is established based on Enron-Email-Dataset for email-worm propagation simulation.Simulation results show that the proposed algorithm can describe the email-worm propagation behavior accurately.The impacts of network topology on email-worm propagation are analyzed and we found that the infected key-nodes can speed up the worm propagation.Also four protection strategies are proposed and examined through experiments.Results show that the imposed protections on key-node can slower the worm propagation.Furthermore,a new email-worm propagation model,named Topo-SIS,is built. Compared with the simulation results,this new model can predict the size of affected users accurately.

关 键 词：计算机系统结构 Email蠕虫传播仿真 网络拓扑 用户行为 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]