实时混合对抗蠕虫建模和分析.docVIP

实时混合对抗蠕虫建模和分析 　　摘 要：传统的防病毒技术难以抵御蠕虫的传播，为此本文提出实时混合对抗技术，该技术在被对抗蠕虫感染的主机与易感染主机数量相等时转换对抗策略，并建立实时混合对抗蠕虫的传播模型.最后，通过仿真实验从对抗有效性、资源消耗和应对突发事件能力三个方面验证实时混合对抗技术的性能.理论分析和实验结果表明，实时混合对抗技术能更好地满足对抗有效性和低资源消耗要求，并能应对突发事件. 　　关键词：网?j安全；网?j蠕虫；对抗蠕虫；传播模型；实时混合对抗技术 　　中图分类号：TP309.5 文献标识码：A 　　 　　Modeling and Analysis of Real-time Hybrid Anti-worms 　　 QIN Zheng1, LI Jun-qun1?k, OU Lu1, Alex X. Liu2 　　(1. College of Software, Hunan Univ, Changsha, Hunan 410082，China; 　　 2. Dept of Computer Science and Engineering, Michigan State Univ, East Lansing, Michigan 48824-1266, USA) 　　Abstract:Owing to the difficulties of traditional anti-virus technologies against internet worms, more and more attention has been paid to anti-worm in the field of malicious code. Real-time hybrid confronting technology was presented to solve the shortcomings of the existing confronting technologies in confronting validity, resource consumption and the ability to handle accidents, which changes confronting tactic according to the radio of hosts infected by anti-worm to susceptible hosts. And the propagation model of real-time hybrid anti-worm was constructed. Finally, the performance of real-time hybrid confronting technology was validated by simulation experiments on confronting validity, resource consumption and ability to handle accidents. Analyses and experiments have indicated that real-time hybrid confronting technology is better than other technologies on confronting validity with low resource consumption, and can handle accidents. 　　Key words:network security; worm; propagation model; real-time hybrid confronting technology 　　 　　网?j蠕虫呈现智能化、自动化特征，综合网?j攻击、密码学和计算机病毒技术，是一种不需要计算机使用者干预即可运行的攻击程序或代码[1].网?j蠕虫主要利用计算机漏洞进行传播，搜索到网?j中存在漏洞的主机后主动进行攻击[2].随着网?j应用的多样化，网?j蠕虫已成为网?j安全的主要威胁之一，其爆发造成了巨大的经济损失.而防病毒技术、入侵检测技术和防火墙技术等难以抵御迅速传播的网?j蠕虫.研究者提出了一种以毒攻毒的思想，利用对抗蠕虫抑制网?j蠕虫[3]. 　　目前对抗蠕虫所采用的对抗技术主要有两种：主动对抗技术和被动对抗技术.无论是主动对抗技术还是被动对抗技术，均无法全面解决对抗蠕虫所面临的对抗有效性和网?j资源消耗这两方面的主要问题[3].文献[4]中对简单混合对抗技术和主动对抗技术进行了比较分析，简单混合对抗技术能更好地抑制网?j蠕虫的传播，但采用简单混合对