IPv6网络环境下的蠕虫传播模型研究  

Research on worm propagation model in IPv6 networks

作　　者：苏飞[1] 林昭文[1] 马严[1,2] 杨晓明[3] 

机构地区：[1]北京邮电大学网络与交换技术国家重点实验室,北京100876 [2]北京邮电大学智能通信软件与多媒体北京重点实验室,北京100876 [3]工业和信息化部电子第五研究所,广东广州510610

出　　处：《通信学报》2011年第9期51-60,共10页Journal on Communications

基　　金：教育部留学归国实验室建设项目;教育部科技基础资源平台项目(507001);国际科技合作项目(S2010GR0902);中央高校基本科研业务费基金资助项目(2009RC0502);国家高技术研究发展计划("863"计划)基金资助项目(2011AA010704)~~

摘　　要：研究了IPv6网络中,蠕虫在子网间和子网内传播的多种扫描策略;讨论了基于P2P的去重复和可控机制;研究了一种能够在IPv6网络中形成大规模传播的新型混合式蠕虫——NHIW。NHIW具有随机扫描蠕虫的特点,同时能够迅速获取子网内的易感染活跃主机IPv6地址,并能解决重复感染的问题。通过研究NHIW不同传播阶段的时延,理论分析其传播率,建立了NHIW的3层传播模型TLWPM。实验表明,NHIW能够在IPv6网络中形成大规模传播。最后,针对NHIW的特点,讨论了相关防御策略。A wide variety of scanning strategies for IPv6 networks when a worm scans across subnets and inside subnets was investigated.A P2P-based mechanism for decreasing the repeated infection and implementing control strategies was discussed,and a new hybrid worm named NHIW,which can form large-scale propagation in IPv6 network,was also constructed.The NHIW can not only scan the worm randomly,but also can quickly obtain IP addresses of susceptible active hosts in the subnet as well.Furthermore,NHIW is able to prevent re-infection of the host.Through analyzing the delay in different stage of NHIW propagation and its propagation rate,a full NHIW propagation model TLWPM was established.Experimental results show that NHIW can form a flooding propagation in the IPv6 network.With respect to the features of NHIW,some relevant defense strategies were discussed finally.

关 键 词：IPV6网络 网络蠕虫 蠕虫模型 扫描策略 时延 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]