无线传感网中移动式蠕虫的抑制与清理

在无线传感器网络(Wireless Sensor Networks, WSNs)中引入移动节点可以极大地提升网络性能。然而,移动节点一旦被蠕虫感染则会大大加快蠕虫在WSNs中的传播。针对这一新的研究问题,该文分2步来抑制和清理移动蠕虫传播源。首先建立了移动蠕虫感染模型,设计启发式算法以确定移动感染区域的边界,通过挂起感染边界附近的高风险节点来阻断蠕虫的进一步传播。第2步设计定向扩散的良性蠕虫对网络中被感染的节点进行修复,以彻底清除蠕虫病毒。理论分析和仿真实验结果均表明,该文所提方法能够在付出较小的代价下达到较好的移动蠕虫清理效果,适合能量受限的无线传感器网络。     

一种基于Netflow的蠕虫攻击检测方法研究

文中在分析Netflow原理和蠕虫攻击行为特征的基础上,提出了一种基于Netflow的蠕虫检测方法。对检测算法中的流量异常和特征异常检测模块进行了编码实现,并搭建了相应的实验环境。通过模拟RedCode蠕虫爆发时的网络行为,实验结果表明:该方法可快速、准确地实现常见蠕虫的检测,对新型蠕虫也可实现特征提取和预警。     

IPv4-IPv6双栈良性蠕虫传播模型的研究

通常认为比起IPv4网络来说,能够占据巨大的空间地址的IPv6网络更为安全保险,但其实并非如此。研究发现IPv6网络遭受蠕虫侵害的概率完全不低于IPv4网络,IPv4-IPv6双栈蠕虫在不同网络中的传播速度是有差异的,尤其在IPv4网络向IPv6网络过渡阶段中会造成严重危害。因此利用IPv4-IPv6双栈良性蠕虫来对抗恶性蠕虫的模式成为学者们研究的重点。文章首次梳理了IPv4-IPv6双栈蠕虫相关概念,理清其传播过程,通过分析探索出IPv4-IPv6双栈蠕虫传播过程及其网络对抗的模式,通过数值分析研究恶性蠕虫所造成的危害并提出相应策略,对于防范网络蠕虫及建立计算机免疫系统等方面都有着十分积极的作用。     

基于多播扫描机制的双栈蠕虫研究

IPv4网络到IPv6网络的过渡过程中将出现两种网络协议将共同存在。研究了一种具有分层扫描策略的蠕虫——双栈蠕虫,该蠕虫利用多播扫描策略实现本地IPv6子网内主机的检测,利用IPv4随机地址扫描发现子网外的目标主机。通过在真实网络中进行传播测试和利用仿真程序模拟双栈蠕虫在大规模网络中的传播行为,发现双栈蠕虫可以在IPv4-IPv6双栈网络中快速传播。     

网络蠕虫的扫描方法分析

对网络上计算机系统的扫描是网络蠕虫传播的第一步,网络蠕虫扫描算法是研究蠕虫传播特性的一个基础环节。通过对常见的网络蠕虫扫描算法的研究,将其进行了分类,并对每一种扫描方法的基本原理及特点进行了分析。     

基于自动特征提取的大规模网络蠕虫检测

蠕虫由于传播速度很快在网络中造成了严重的危害,对蠕虫进行自动的快速检测成了一项必需的研究。研究了在大规模网络中,利用流量异常发现模块从网络中发现异常数据集,然后自动进行特征提取,进而将特征更新到特征检测的特征库中进行特征检测的方法,实现对未知蠕虫的检测。本系统能够快速地发现新的疫情,作为蠕虫的自动防御的基础。     

基于Windows主机的未知蠕虫主动检测系统

相对于传统的反病毒软件,本研究提出了一种新的基于主机的蠕虫检测系统.这种新的检测方法通过分析监测已知蠕虫病毒对计算机性能参数造成的影响,对未知的蠕虫进行判决检测,达到网络预警的效果.我们通过监测主机的323个系统特征计数器以反应计算机的性能特征,并利用自行设计的对比特征选择系统对原始数据进行预处理.本研究采用贝叶斯网络分类算法对带有标签的各训练数据子集进行分类训练,产生用以判决未知蠕虫的分类判决规则.在模拟计算机各种应用状态下,我们在搭建的实验局域网上对这种新的监测系统进行测试评估.本研究提出的检测系统对采集的未知网络蠕虫达到80%以上的判决准确率,对已知蠕虫有着99%以上的检测准确率,有着很高的实用性和推广性.     

基于FPGA的硬件蠕虫检测系统的设计与实现

分析了现有的蠕虫检测算法的优缺点,提出了基于数据包统计的蠕虫检测算法。该算法简单有效,适合硬件实现。同时设计了一个硬件蠕虫检测系统,最终在FPGA上实现,并对其进行了仿真与综合,验证了设计的正确性。本检测系统适合用于嵌入网卡,实时监测蠕虫,所以该基于FPGA的硬件蠕虫检测系统对蠕虫的检测和抑制具有积极的意义。     

基于随机进程代数的P2P网络蠕虫对抗传播特性分析

 研究P2P网络中良性蠕虫和恶意蠕虫在对抗传播过程中的特性,可为制定合理的蠕虫对抗策略提供科学依据.提出一种基于随机进程代数的P2P网络蠕虫对抗传播的建模与分析方法.首先,分析了传播过程中蠕虫之间的对抗交互行为以及网络节点的状态转换过程;然后,利用PEPA语法建立了恶意蠕虫初始传播阶段与蠕虫对抗阶段的随机进程代数模型;最后,采用随机进程代数的流近似方法,推导得到能够描述蠕虫传播特性的微分方程组,通过求解该方程组,分析得到P2P蠕虫的对抗传播特性.试验结果表明,良性蠕虫可以有效遏制P2P网络中的恶意蠕虫传播,但需要根据当前的网络条件制定科学的传播策略,以减少良性蠕虫自身的传播对网络性能的影响.     

Web安全问答（2）

问：什么叫网络蠕虫 答：一般认为：蠕虫病毒是一种通过网络传播的恶性病毒,它除具有病毒的一些共性外,同时具有自己的一些特征,如不利用文件寄生（有的只存在于内存中）,对网络造成拒绝服务,以及与黑客技术相结合等等。蠕虫病毒主要的破坏方式是大量的复制自身,然后在网络中传播,严重的占用有限的网络资源,最终引起整个网络的瘫痪,使用户不能通过网络进行正常的工作。每一次蠕虫病毒的爆发都会给全球经济造成巨大损失,因此它的危害性是十分巨大的;有一些蠕虫病毒还具有更改用户文件、将用户文件自动当附件转发的功能,更是严重的危害到用户的系统安全。     

Modeling and analysis of Internet worm propagation

Although the frequency of Intemet worm's outbreak is decreased during the past ten years,the impact of worm on people's privacy security and enterprise's efficiency is still a severe problem,especially the emergence of botnet.It is urgent to do more research about worm's propagation model and security defense.The well-known worm models,such as simple epidemic model (SEM) and two-factor model (TFM),take all the computers on the internet as the same,which is not accurate because of the existence of network address translation (NAT).In this paper,we first analyze the worm's functional structure,and then we propose a three layer worm model named three layres worm model (TLWM),which is an extension of SEM and TFM under NAT environment.We model the TLWM by using deterministic method as it is used in the TFM.The simulation results show that the number of NAT used on the Intemet has effects on worm propagation,and the more the NAT used,the slower the worm spreads.So,the extensive use of NAT on the Internet can restrain the worm spread to some extent.     

物联网恶意代码传播模型研究

Nowadays, the main communication object of Internet is human-human. But it is foreseeable that in the near future any object will have a unique identification and can be addressed and connected. The Internet will expand to the Internet of Things. IPv6 is the cornerstone of the Internet of Things. In this paper, we investigate a fast active worm, referred to as topological worm, which can propagate twice to more than three times faster than a traditional scan-based worm. Topological worm spreads over AS-level network topology, making traditional epidemic models invalid for modeling the propagation of it. For this reason, we study topological worm propagation relying on simulations. First, we propose a new complex weighted network model, which represents the real IPv6 AS-level network topology. And then, a new worm propagation model based on the weighted network model is constructed, which describes the topological worm propagation over AS-level network topology. The simulation results verify the topological worm model and demonstrate the effect of parameters on the propagation.     

Improving wireless sensor networks performance through epidemic model

Wireless sensor networks (WSNs) encounter a critical challenge of ‘Network Security’ due to extreme operational constraints. The origin of the challenge begins with the entry of worms in the wireless network. Just one infected node is enough to spread the worms across the entire network. The infected node rapidly infects the neighbouring nodes in an unstoppable manner. In this paper, a mathematical model is proposed based on epidemic theory. It is an improvement of the Susceptible-Infectious-Recovered-Susceptible (SIRS) and Susceptible-Exposed-Infectious-Susceptible (SEIS) model. We propose Susceptible-Exposed-Infectious-Recovered-Susceptible (SEIRS) model that overcomes the drawbacks of existing models. The proposed ameliorated model includes a finite communication radius and the associated node density. We obtain basic reproduction number which determines the local and global propagation dynamics of worm in the WSNs. Also, we deduce expression for threshold for node density and communication radius. We investigated the control mechanism against worm propagation. We compare the proposed model with various existing models and evaluate its performance on the basis of various performance metrics. The study confirms melioration in the vital aspects (security, network reliability, transmission efficiency, energy efficiency) for WSNs. The proposed SEIRS model provides an improved technique to restraint worms’ transmission in comparison to the existing models.     

基于潜伏期的网络蠕虫传播模型及其仿真分析

随着Internet的迅速发展，网络蠕虫已严重威胁着网络信息安全。现有的网络蠕虫传播模型仅仅考虑了网络蠕虫传播的初始阶段和达到稳定状态时的网络特性．不能刻画网络蠕虫快速传播阶段的网络特性。文章运用系统动力学的理论和方法．建立一种基于潜伏期的网络蠕虫传播模型，能够从定性和定量两方面分析和预测网络蠕虫传播趋势。模拟结果表明网络蠕虫潜伏期与免疫措施强度是影响网络蠕虫传播过程的重要因素。     

容错型令牌总线网性能评价算法

本文对符合ＩＥＥＥ８０２．４和ＭＡＰ标准的令牌总线网的性能指标评估给出了一种新的计算方法。文中重点考虑了具有信包重发机制、令牌最大保留时间和信包缓冲区容量有限的令牌网络的性能指标评估问题，克服了以往不能分析同时具有信包重发机制和令牌最大保留时间令牌网性能的局限。文中给出的方法简单易行、计算迅速、精度颇高。最后，本文通过例题说明了此方法的应用。     

基于PSO-BP算法的无线传感器网络定位优化

在研究现有定位算法的基础上,针对基于接收信号强度指示(RSSI)定位模型中的参数易受环境影响等问题,提出了一种新型的粒子群优化(PSO)算法与后向传播(BP)神经网络相结合的算法.BP网络算法权值的修正依赖于非线性梯度值,易形成局部极值,同时学习次数较多,需先通过粒子群算法进行优化.为了提高定位精度,首先采用速度常量法滤波处理,然后通过改进的混合优化算法对BP神经网络初始权值和阈值进行优化,并分析算法的性能.试验中隐层节点个数采用试错法,从12到19变化,以确定合适数目.实验结果表明,与一般加权算法和传统BP算法相比,改进的混合优化算法可大幅改善测距误差对定位误差的影响,同时可使25 m内最小定位误差小于0.27 m.     

TDMA scheduling design of multihop packet radio networks based onlatin squares

Many transmission scheduling algorithms have been proposed to maximize spatial reuse and minimize the time division multiple access (TDMA) frame length in multihop packet radio networks. Almost all existing algorithms assume exact network topology information and require recomputations when the network topology changes. In addition, existing work focuses on single channel TDMA systems. In this paper, we propose a multichannel topology-transparent algorithm based on latin squares. The proposed algorithm has the flexibility to allow the growth of the network, i.e., the network can add more mobile nodes without recomputation of transmission schedules for existing nodes. At the same time, a minimum throughput is guaranteed. We analyze the efficiency of this algorithm and examine the topology-transparent characteristics and the sensitivity on design parameters by analytical and simulation techniques     

A new worm exploiting IPv6 and IPv4-IPv6 dual-stack networks: experiment, modeling, simulation, and defense

It is commonly believed that the IPv6 protocol can provide good protection against network worms that try to find victims through random address scanning due to its huge address space. However, we discover that there is serious vulnerability in terms of worm propagation in IPv6 and IPv4-IPv6 dual-stack networks. It is shown in this article that a new worm can collect the IPv6 addresses of all running hosts in a local subnet very quickly, leading to accelerated worm propagation. Similar to modeling the self-replicating behaviors of biological viruses, a Species-Patch model and a discrete-time simulator are developed to study how the dual-stack worm spreads in networks with various topologies. It is shown that the worm could propagate in the IPv6 and IPv4-IPv6 dual-stack networks much faster than in the current IPv4 Internet. Several effective defense strategies focusing on network deployment are proposed.     

一种改进的分布式最大权独立集算法

能快速准确寻找给定图中的最大权独立集的分布式算法,对于解决无线网络中的资源调配、无线骨干网构建等问题具有非常重要的指导意义。该文以基于最大乘信用传播的分布式算法为框架,假设所有节点了解自己邻居节点之间的局部拓扑信息,启发式地提出一种新的相邻节点间交换消息的计算方法以及相应的分布式最大权独立集算法。仿真结果表明,所提算法摆脱了文献中已有算法对图结构必须是树或者二分图的要求,且权和性能优于已有的分布式算法。