基于随机实验的蠕虫传播预测研究

蠕虫传播预测是蠕虫防御的基础之一，但随着蠕虫扫描策略日趋多样和互联网结构逐步复杂，在蠕虫爆发初期及时建立精确的蠕虫传播模型变得越来越困难。利用随机仿真实验来模拟蠕虫在网络中的传播行为，通过统计分析仿真实验结果，发现蠕虫传播实验结果是一个随机过程，而实验结果间存在很高的线性相关性。由此提出一种基于仿真实验统计结果的蠕虫传播趋势预测方法，该方法可以利用0．1％存在漏洞主机的感染信息精确的预测蠕虫传播趋势。

Research of worm-propagation prediction based on stochastic experiment

The prediction of the worm propagation is the basis of the worm defense. It is becoming more difficult to model the propagation of worms in the early stage of worm-spreading, because the worm strategies are smarter and the Internet structure is more complicated than ever before. In present study, a stochastic simulator was designed to simulate the propagation of worms. From the analysis of 1000 groups of experiment results, it was proved that the worm-propagation is a stochastic process, and the correlation coefficient between each group of results is close to 1. Therefore, a new prediction method was proposed, which could accurately calculate the propagation of worm when 0. 1% of all vulnerable hosts were infected.