结构化对等网络中P2P僵尸网络传播模型  

Propagation Modeling for P2P Botnet in Structured P2P Network

作　　者：钱权[1,2] 萧超杰[1,2] 张瑞[1,2] 

机构地区：[1]上海大学计算机工程与科学学院,上海200072 [2]中国科学院软件研究所信息安全国家重点实验室,北京100190

出　　处：《软件学报》2012年第12期3161-3174,共14页Journal of Software

基　　金：国家自然科学基金(61003248);国家教育部博士点基金(20093108120016);上海教委重点学科(J50103);上海教委创新基金(09YZ05)

摘　　要：依赖结构化对等网传播的P2P僵尸是未来互联网面临的重要威胁.详细分析了两种典型的结构化P2P协议Chord和Kademlia的工作原理,在此基础上,使用数学建模的方法建立了结构化P2P僵尸网络的传播模型.该模型将Kademlia,Chord协议与双因子免疫机制、主机在线率等因素相结合,较为全面地研究了两种典型的结构化P2P网络中僵尸的传播机理,并使用软件仿真的方法模拟了节点超过百万时,结构化P2P网络中僵尸的传播行为,通过软件仿真得出的数据与理论数据进行对比,验证了模型的正确性.从实验结果可以看出:对于Kademlia和Chord两种结构化P2P网络,僵尸传播无论是双因子免疫模型还是结合双因子与主机在线率的模型,理论模型与仿真结果都非常吻合,体现了模型的准确性,为僵尸的检测与防御提供了理论依据.Depending on the structured peer-to-peer networks, the P2P botnets are the main threats of the Internet in the future. In this paper, a formal mathematical P2P botnet propagation model is built based on a deep analysis of two typical structured P2P protocols, Chord and Kademlia. This model, it integrates different factors, such as structured P2P protocols, two-factor immunizations, and host online rates to describe the structured P2P botnet propagation mechanisms comprehensively. Meanwhile, in order to evaluate the model effectiveness, simulate the P2P botnets propagation, the difference between the theoretical model and the simulation is used to verify the model efficiency. The experiments prove the correctness of the theoretical model also verify the different influences of structured P2P protocols, immunization mechanisms, and the host online rates on P2P botnet propagation. Moreover, through simulating P2P network with millions of nodes, it can be shown that the propagation model is correct and valid in large scale network, which provides a theoretical basis for botnet detection and prevention.

关 键 词：网络安全 结构化对等网 P2P僵尸网络 传播模型 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]