具有permutation扫描特征的多态蠕虫传播实验仿真  

Experimental simulation of polymorphic worm propagation with permutation-scanning characteristic

作　　者：汪洁[1] 何小贤[1] 

机构地区：[1]中南大学信息科学与工程学院,长沙410083

出　　处：《计算机应用研究》2011年第10期3786-3789,共4页Application Research of Computers

基　　金：中南大学自由探索计划资助项目(2001QNZT035)

摘　　要：大部分蠕虫建模工作都是基于相对简单的随机扫描蠕虫,而且蠕虫的形态是相对固定的。随着蠕虫技术的显著提高,在传播方式上出现了较高级的传播方式如permutation扫描,同时出现了能改变蠕虫形态的多态变形技术。为了更好地理解该类型蠕虫的传播特性,首先研究permutation扫描技术,然后构建实验模拟具有permutation扫描特性的多态蠕虫传播。分析当环境中不存在IDS时,各类蠕虫数目和被感染主机的运行情况,当环境中存在IDS时,各参数对多态蠕虫传播过程的影响。最后在仿真的基础上对蠕虫传播的动力学机制进行了总结,对防御方法进行了初步探讨。Most of models are based on single random scanning,and worm has relatively fixed morphology.With the improvement of worm technique,complicate propagation like permutation scanning and polymorphic technique emerge.To comprehend well propagation characteristics of polymorphic worm with permutation scanning,this paper did some research on permutation scanning technique.Then constructed experimental to simulate propagation of polymorphic worm with permutation scanning.It analyzed the number of different worm types and running conditions of infected hosts when there was not IDS system in the environment.In addition,analyzed influence of different parameters to worm propagation when there exits IDS system in the environment.Finally,summarized dynamics mechanism of worm propagation based on our experimental simulation,and studied defense method against worm preliminarily.

关 键 词：排列扫描 多态蠕虫 实验仿真 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]