蠕虫的双时延传播模型及其稳定性研究

发布时间：2018-06-21 16:24

本文选题：蠕虫传播模型 + 双时延　；参考：《东北大学》2014年硕士论文

【摘要】：随着互联网技术的迅猛发展,网络技术的应用已经进入人们日常生活的各个角落。在给人们生活带来便利的同时,也为蠕虫的大肆传播创造了条件。建立蠕虫传播模型是我们研究蠕虫传播的重要手段之一。然而蠕虫的真实传播是异常复杂的,如人们清杀蠕虫的操作、机器的重装系统、蠕虫感染的潜伏行为都会给蠕虫的传播带来多种时间延迟。这就使得传统的单时延蠕虫传播模型不能够真实的模拟蠕虫在现实世界中的传播情况,因此如何准确地预测蠕虫在网络中真实的传播已成为时下重要的课题。本文在传染病学和非线性动力学的研究成果基础上,首先对由于清杀操作所导致的时延在蠕虫传播中产生的影响进行了分析并且建模,提出了具有免疫时延的SIDV蠕虫传播模型,然后对此模型进行了稳定性分析和数值模拟。为了更加真实地预测和遏制蠕虫的传播,本文在SIDV模型的基础上,提出了更加完整的抑制策略,即采用入侵检测系统的隔离策略。由于其中的滥用检测系统通过设置时间窗口来提高检测率,而时间窗口会导致系统产生时延因素。因此,本文提出了蠕虫双时延传播模型,并且对蠕虫双时延传播模型进行稳定性分析和Hopf分岔分析。理论推导表明,蠕虫双时延模型对于两个时延分别存在一个时延临界值,当两个时延均小于它们的临界值时,系统是稳定且易于控制的,而且在使用隔离策略之后,感染主机的最终数量也有明显的下降；而当其中一个时延超出临界值或者两个时延同时超出临界值时,系统就会出现Hopf分岔,从而致使蠕虫的传播无法控制,并且抑制策略失效。这表明,人们应该在主机感染蠕虫后及时的清杀蠕虫并且时间窗口的尺寸应该控制小于隔离时延的阈值,从而保证整个传播系统的稳定性。为了验证结论,本文进行了数值模拟与仿真实验,实验结果证明了本文理论分析的正确性。
[Abstract]:With the rapid development of Internet technology, the application of network technology has entered every corner of people's daily life. While bringing convenience to people's lives, it also creates conditions for the rampant spread of worms. Establishing worm propagation model is one of the important methods to study worm propagation. However, the real propagation of worms is extremely complicated. For example, the operation of killing worms, the reloading of machines, and the latent behavior of worm infection will bring a variety of time delays to the propagation of worms. This makes the traditional single-delay worm propagation model can not really simulate the worm propagation in the real world, so how to accurately predict the real worm propagation in the network has become an important issue. Based on the research results of infectious diseases and nonlinear dynamics, this paper first analyzes the effects of the delay caused by the killing operation on the propagation of worms, and proposes a SIDV worm propagation model with immune delay. Then the stability analysis and numerical simulation of the model are carried out. In order to predict and control worm propagation more realistically, this paper proposes a more complete suppression strategy based on SIDV model, that is, the isolation strategy of intrusion detection system (IDS). Because the abuse detection system can improve the detection rate by setting the time window, the time window will lead to the delay factor of the system. Therefore, a worm double delay propagation model is proposed, and the stability analysis and Hopf bifurcation analysis of the worm double delay propagation model are carried out. The theoretical derivation shows that the worm dual delay model has a delay critical value for each of the two delays. When both time delay is less than their critical value, the system is stable and easy to control, and after using the isolation strategy, the system is stable and easy to control. The final number of infected hosts is also significantly reduced; when one of the delays exceeds the threshold or when both delays exceed the threshold, Hopf bifurcation occurs in the system, causing the worm to spread out of control. And the inhibition strategy is invalid. This indicates that people should kill the worm in time after the host is infected and the size of the time window should be controlled less than the threshold of the isolation delay to ensure the stability of the whole transmission system. In order to verify the conclusion, numerical simulation and simulation experiments are carried out, and the experimental results prove the correctness of the theoretical analysis.
【学位授予单位】：东北大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【参考文献】