analysis of instant messaging group worms分析即时通讯集团的蠕虫.pdfVIP

International Journal of Distributed Sensor Networks, 5: 103, 2009 Copyright Taylor Francis Group, LLC ISSN: 1550-1329 print / 1550-1477 online DOI: 10.1080/15501320802575278 Analysis of Instant Messaging Group Worms WEI WANG, MING XIE, DAISHENG LUO, and YONG FANG School of Electronics and Information Engineering, Sichuan University, Chengdu, China Instant Messaging group is the new feature added into the IM system. In the IM group network, two IM users are considered connecting if they are in the same group, which is the essential difference from previous topology. We study worms under IM group topology for the first time. After analyzing the real data, we propose some new propagation approaches of worms and prove their efficiency. To prevent IM group worms, we propose some new defense methods and define some new items. Results can be greatly helpful to administrators of the IM service. 1. Introduction The topology of IM has been proved as a scale-free [1], but the group feature of IM is not considered in the previous work. Motivated by this, we do the research on the worms under IM group topology for the first time. 2. The Statistics We use QQ, the largest IM software in China, to do the research. We write a network spider to get the information of groups and members. The statistics feature of IM group: No. of links per user is 106.89, clustering coefficient is 0.54, and average diameter is 4.58. 3. Experiments We simulate worms on the real topology. The results show that reinfection and non- reinfection have the same propagation speed. A group sensitive infection case introduces nearly zero traffic, and the initial speed is as fast as others. To defend IM group worms, we make the definitions of ‘‘vaccination’’ and ‘‘immu- nization.’’ Vaccination means disabling the accounts of the most connected points on the network to increase the network’s diameter. Immunization