Simulation Of Scanning Based Network Worms

Internet worm spread through a variety of ways and can replicate itself and destroy computer systems, blocking computer networks. With the rapid development of network technology, network worms of the computer system security and network security threats increasing the spread of Internet worms has become the network of the world's a serious public nuisance. 2001 Code Red worm outbreak caused by paralysis of the world's nearly 40 million hosts, followed by the outbreak of the Nimda worm caused economic losses of hundreds of millions, in 2003 the outbreak of the shock wave in the world-wide PC-made damage to the number is much larger than eight million. In the past few years, the worm technology has been becoming more and more mature, almost every day a new worm virus has emerged and its complexity is also increasing, resulting in computer users keep track of time, may give the world any department, organization or national cause, large or small losses.In order to analyze the scan and propagation of the worm to study the worm defense strategy, effective prevention and control of large-scale spread of the worm, the need for a more appropriate research environment to study the worm propagation phenomena and characteristics of related issues, and has been raised against solutions, network worms simulation technology is needed in such a background arising under.There are three kinds of worms present simulation technology. One is the worm propagation in mathematical description of analytical methods, but these models are too simple, topology-aware worm propagation can not meet the needs of systems analysis. The other is a packet-level worm simulation model, through the introduction of network simulation technology, to build the worm propagation network simulation environment, according to logical rules of conduct simulated worm worm traffic, but the existing data packet-level worm simulation targeted active scanning worms, the lack of logical topology model generation algorithm and implementation. Between analytical model is a mathematical simulation and packet-level worm simulation between a simulation method, it takes into account the spread of the worm each time at different nodes in the state of change and its probabilistic model, worm propagation as a Markova process, using discrete-time simulation of a way forward. The simulation to simulate the spread of the worm process of worm propagation can be a better guarantee of the safety of research laboratories, testing with higher performance and lower cost of wear and tear. In this paper, a high degree of abstraction based on the simulation of virtual network worm propagation characteristics of selective abstraction, to overcome the bottleneck of external conditioning constraints, build-related worm simulation model, simulation of worm propagation through nodes in the flow of infection, analysis of the characteristics of worm propagation. This paper first outlines the basic concepts of network worms and the development of history, including the structure and function of the worm scans the common strategy. Second, summed up the worm scanning strategies and dissemination of models and major progress in research to evaluate the advantages and disadvantages of each model. Then, the worm spread simulation part of the flow model has been designed, mainly scanning part and the part of the propagation model, and use C language implementation of the simulation system for scanning worms carried out simulation, and simulation results were compared. Finally, this article summarizes the existing problems of the future might do the work put forward.