Research and Development of P2P Worms

With the development and the application of many popular peer-to-peer (P2P) systems such as eMule and BitTorrent,worms probably employ the features of these P2P networks to put them at risk.Some features,such as the local routing table and the application routing mechanism,are helpful to quickly distribute the P2P worms into the networks.This paper aims to give a comprehensive survey of P2P worms.The definition and the classification of P2P worms are discussed firstly.Then,the research and development of P2P worms, including experimental analysis,propagation modeling,and defensive approaches,are addressed and analyzed in detail.     

基于随机进程代数的P2P网络蠕虫对抗传播特性分析

研究P2P网络中良性蠕虫和恶意蠕虫在对抗传播过程中的特性,可为制定合理的蠕虫对抗策略提供科学依据.提出一种基于随机进程代数的P2P网络蠕虫对抗传播的建模与分析方法.首先,分析了传播过程中蠕虫之间的对抗交互行为以及网络节点的状态转换过程;然后,利用PEPA语法建立了恶意蠕虫初始传播阶段与蠕虫对抗阶段的随机进程代数模型;最后,采用随机进程代数的流近似方法,推导得到能够描述蠕虫传播特性的微分方程组,通过求解该方程组,分析得到P2P蠕虫的对抗传播特性.试验结果表明,良性蠕虫可以有效遏制P2P网络中的恶意蠕虫传播,但需要根据当前的网络条件制定科学的传播策略,以减少良性蠕虫自身的传播对网络性能的影响.     

Modeling and analysis of Internet worm propagation

Although the frequency of Intemet worm's outbreak is decreased during the past ten years,the impact of worm on people's privacy security and enterprise's efficiency is still a severe problem,especially the emergence of botnet.It is urgent to do more research about worm's propagation model and security defense.The well-known worm models,such as simple epidemic model (SEM) and two-factor model (TFM),take all the computers on the internet as the same,which is not accurate because of the existence of network address translation (NAT).In this paper,we first analyze the worm's functional structure,and then we propose a three layer worm model named three layres worm model (TLWM),which is an extension of SEM and TFM under NAT environment.We model the TLWM by using deterministic method as it is used in the TFM.The simulation results show that the number of NAT used on the Intemet has effects on worm propagation,and the more the NAT used,the slower the worm spreads.So,the extensive use of NAT on the Internet can restrain the worm spread to some extent.     

Modeling and analysis of Intemet worm propagation

Although the frequency of Internet worm's outbreak is decreased during the past ten years, the impact of worm on people's privacy security and enterprise's efficiency is still a severe problem, especially the emergence of botnet. It is urgent to do more research about worm's propagation model and security defense. The well-known worm models, such as simple epidemic model (SEM) and two-factor model (TFM), take all the computers on the internet as the same, which is not accurate because of the existence of network address translation (NAT). In this paper, we first analyze the worm's functional structure, and then we propose a three layer worm model named three layres worm model (TLWM), which is an extension of SEM and TFM under NAT environment. We model the TLWM by using deterministic method as it is used in the TFM. The simulation results show that the number of NAT used on the Internet has effects on worm propagation, and the more the NAT used, the slower the worm spreads. So, the extensive use of NAT on the Internet can restrain the worm spread to some extent.     

对等网络资源搜索模型研究

为了提高结构化P2P网络的查询性能,提出P2P网络搜索延时模型,通过分析结构化P2P网络的搜索过程,利用马尔可夫链,得出P2P网络平均节点会话时间和搜索延时之间的关系。该模型展现了P2P Churn与网络性能之间的内在规律,进而达到改善结构化P2P的性能和应用范围的目的。     

基于失败连接分析和P2P的未知网络蠕虫检测

针对现有的网络蠕虫检测系统大多不能有效快速检测慢速蠕虫的问题,本文提出使用本地失败连接分析(LF-CA)算法在蠕虫传播早期高效实时的检测本地局域网内的蠕虫,并在全局上建立可扩展性强非集中式的基于Chord算法的全网协作P2P检测机制,以信息共享的方式对慢速传播蠕虫进行检测。通过实验仿真验证了LFCA算法对本地网络的快速蠕虫有高效的检测效果和较低的误报率,证明了基于P2P技术进行信息共享协同检测比单点检测能更快更有效地检测到慢速蠕虫。     

P2P网络中激发型蠕虫传播动态建模

鉴于激发型蠕虫的巨大危害性,本文在考虑网络动态变化的情况下对激发型蠕虫的传播进行了深入地研究,提出了激发型蠕虫动态传播数学模型和免疫模型,并基于动态传播数学模型推导出了激发型蠕虫不会泛滥的充分条件.大规模仿真实验验证了传播模型的有效性和蠕虫不会泛滥充分条件的正确性.基于传播模型的分析表明,下载率是影响蠕虫传播的关键因素,蠕虫基本繁殖率是衡量蠕虫传播能力的关键指标.基于实测P2P网络数据和传播模型,预测和估计了激发型蠕虫的传播能力、传播速度和危害性,指出尽早重视P2P激发型蠕虫特别是尽早找到检测和控制方法的重要性和迫切性.     

物联网恶意代码传播模型研究

Nowadays, the main communication object of Internet is human-human. But it is foreseeable that in the near future any object will have a unique identification and can be addressed and connected. The Internet will expand to the Internet of Things. IPv6 is the cornerstone of the Internet of Things. In this paper, we investigate a fast active worm, referred to as topological worm, which can propagate twice to more than three times faster than a traditional scan-based worm. Topological worm spreads over AS-level network topology, making traditional epidemic models invalid for modeling the propagation of it. For this reason, we study topological worm propagation relying on simulations. First, we propose a new complex weighted network model, which represents the real IPv6 AS-level network topology. And then, a new worm propagation model based on the weighted network model is constructed, which describes the topological worm propagation over AS-level network topology. The simulation results verify the topological worm model and demonstrate the effect of parameters on the propagation.     

Simulating Greedy Propagation of P2P Worms

Greedy propagation policy for un-structured P2P worms employs the neighboring node list of each node in peer-to-peer(P2P) network to speed up the propagation of P2P worms.After describing the technique background of P2P worms,the algorithm of greedy propagation is addressed.Simulating design for this novel propagation policy is also described.Then,the effects of the greedy propagation policy on spreading speed,convergent convergence speed,and attacking traffic in static P2P worms are simulated and discussed.The primary experimental results show that the greedy propagation is harmful and can bring severe damages to P2P network.     

P2P对等网络路由模型及关键技术分析

介绍了P2P网络的技术发展,详细分析了4种典型的P2P网络结构,论述了P2P网络发展的关键技术,对P2P网络的特性以及存在的问题进行了探讨,为P2P网络更深层次的应用奠定基础。     

非结构型点对点网络下的拓扑调整算法研究

在非结构型点对点网络中增加节点时,造成的拓扑失衡问题会导致信息发送延迟时间和跳跃次数的增加。提出了面向分布式的拓朴改进方法,阐述了关键技术部分。通过模拟实验表明,该方法可以有效降低网络的跳跃次数与网络等待时间,满足了实际环境中实时处理的需要。     

Cloud-P2P云存储结构的模型建立与性能分析

基于Cloud-P2P云存储结构,针对云中心和P2P节点存储层数据副本的访问机制,考虑节点存储层数据副本的修复过程,建立一个三维连续时间Markov链模型。使用矩阵几何解方法导出该模型的稳态解,并给出节点存储层传输率,数据访问延迟和副本修复率等系统性能指标的表达式。通过数值实验和系统仿真定量刻画数据副本数等系统参数对Cloud-P2P云存储结构性能的影响。构造利润函数,进行用户存储层副本数的优化设置。     

P2P网络中抑制恶意节点的研究综述

随着P2P网络的迅速发展,它在各个领域被广泛应用,但由于P2P网络自身开放性、匿名性等特点,使网络中存在许多欺骗性、合谋性以及策略性的恶意节点,影响其有效性和可用性.目前存在许多信任模型都分别给出了抑制各种恶意节点的方法,文中从恶意节点出发,总结了典型信任模型中抑制恶意节点的主要方法.     

P4P：P2P的替代者

P2P网络的出现,成功地实现了可扩展的网络应用设计,并且已经成为一种新的范式。然而,P2P也面临着如何高效和公平地利用网络资源的挑战。特别是,缺乏明确地与网络供应商进行沟通,P2P的应用程序可能会消耗太多的带宽,使网络运营商负担不起,导致供应商采取很多限制P2P的措施。文章提出了一个简单,轻量的P4P结构,以便更有效地与网络供应商合作,最终更加高效地利用网络资源。     

P2P网络资源传播模型分析及监测

P2P网络传输是当今互联网中最主要的应用之一,它的流行使得互联网上资源的共享变得十分便捷,同时也使得传播控制和信息监管变得十分困难。这里以经典的病毒传播模型为基础,提出了一个复杂、快速及大范围网络的传播模型,实现了一个针对BT和eMule下载的传播监测系统,该系统可以对某个资源的网络传播进行扩散趋势预测和节点定位。该传播模型配合监测系统能够对P2P网络资源传播进行有效的监控和预测分析,使管理者能对网络进行更加有力的监管。     

网络编码在P2P网络中的应用

网络编码是信息论领域的一个重要突破,它不同于信源编码和信道编码,将网络编码应用到P2P网络中是当前研究热点之一,其中具有分布式特点的随机网络编码可广泛应用于P2P网络。对具有非实时性的P2P文件下载应用,为降低随机网络编码引入的复杂性,可对文件分块进行分代,然后采用代内或代间网络编码技术。对具有实时性的P2P流媒体直播和点播,则需要采用具有优先级意识的网络编码技术,包括分层网络编码,或与推拉技术相结合来实现高效率的P2P流媒体分发。     

Modeling and analysis of access transparency and scalability in P2P distributed systems

Peer‐to‐peer (P2P) systems have been developed with the goal of providing support for transparent and efficient sharing of scalable distributed resources wherein size scalability is limited by the costs of all types of transparencies, especially data access transparency, which are due to the need for frequent data exchanges between peers and other related communication overheads. We present a model that formulates the relationship between scalability and data access transparency in P2P distributed systems to figure out how large these systems can be scaled up, given the overheads of establishing data access transparency. To validate our model and show how our model can be deployed in real life, we consider a real P2P distributed system as a case study and evaluate how CPU utilization, bandwidth, and data request frequency parameters of our model relate to the amount of effort required by the system management to establish data access transparency. We then calculate the strength of the coefficient of correlation of scalability and data access transparency in the system. The degree of strength of this coefficient allows the system designer to decide at design time whether to allow the use of the model in the management of system at runtime or not. Copyright © 2012 John Wiley & Sons, Ltd.     

P2P技术现状及未来发展

P2P应用软件主要包括文件分发软件、语音服务软件、流媒体软件。目前P2P应用种类多、形式多样,没有统一的网络协议标准,其体系结构和组织形式也在不断发展。P2P应用已占运营商业务总量的60%～80%,P2P应用所产生的流量具有分布非均衡、上下行流量对称、流量隐蔽、数据集中等特性。在P2P技术的发展道路上,有许多尚待解决的问题。版权问题一直是P2P发展的一个不确定因素,如何在技术层面支持合法文件的分发是需要解决的重要问题。安全问题也是P2P领域的重要研究课题,如何在P2P网络中实现数据存取安全、路由安全、用户身份认证和身份管理都需要进一步研究。此外,如果能够实现P2P应用之间的统一资源定位,统一路由,使得P2P技术有一个统一开发标准,那么就能够融合P2P技术,提升P2P应用的整体性能。     

P2P运营模式及P2P业务发展策略

目前主要P2P业务的运营模式主要有:Skype模式、广告模式、商贩模式、网格计算模式、电子商务模式。这些业务运营模式可以降低应用提供门槛,实现系统自激励机制,实现资费分担,增加用户"黏"度。未来,P2P的一个可能的方向是平台化,即形成一个基于P2P的资源交换平台,这个平台对用户进行抽象,对资源进行统一建模,并以一致的方式进行资源标识、注册、索引和搜索。用户之间的交互协议,可以采用标准的会话初始化协议(SIP)方式进行,实现标准化。交互接口可以按照可扩展标记语言(XML)的方式进行定义。不同的应用将基于这个平台构建不同的资源交换模型,并生成不同的应用逻辑。     

P2P网络中一种新型的基于DHT的多关键字信息检索模型

在现有的P2P系统应用中,信息的检索是一项非常重要的内容,但现有的检索机制不够高效.本文针对这个问题,在现有的结构化DHT模型基础上,提出一种新型的多关键字检索模型.在一个P2P节点上存储包含一个资源内容的多个关键字的信息,使用带有权重的多关键字向量代表资源信息,并把请求也表示成带有权重的多关键字向蝌量,对请求和资源信息的向量进行匹配,选取符合要求的信息.仿真和分析表明此方案可以显著改善搜索结果的精确性和大大减少搜索所需的寻路跳数.