P2P僵尸网络传播的抑制策略研究

发布时间：2018-06-24 06:21

本文选题：僵尸网络 + 抑制策略　；参考：《东北大学》2014年硕士论文

【摘要】：随着互联网的迅速普及和相关技术的快速发展,互联网在人们的工作和生活过程中占据着越来越重要的位置,同时网络安全问题也变得越来越严重,网络安全事件的爆发频率逐年上升,其中以Storm等为代表的P2P僵尸网络的出现,引起了安全领域的企业和研究人员的广泛关注。传统的恶意软件传播模型已经不能很好地描述新型的P2P僵尸网络的传播过程,而如何有效地抑制这类僵尸网络在网络中的传播已经成为十分重要的问题。在P2P僵尸网络的传播过程中,网络主机的感染会呈现两阶段性,即首先感染易感染主机,之后感染主机加入僵尸网络。为了更好地抑制P2P僵尸网络的传播,本文提出完整的抑制策略,建立僵尸网络的检测、隔离、免疫、清杀、虚拟补丁化等相关抑制技术综合运用的完整体系,以限制P2P僵尸网络的传播。基于P2P系统的隔离策略会有效地抑制感染主机的攻击,而虚拟补丁策略则会增强对易感染主机的保护。在P2P僵尸网络的传播过程中,网络主机的感染会呈现两阶段性,根据这个特点建立P2P僵尸网络两阶段感染传播模型一SIIR模型,借此分析和研究P2P僵尸网络的传播特性。在SIIR模型的基础上,提出基于入侵检测系统的P2P隔离策略来抑制感染主机的增长,达到对P2P僵尸网络传播的抑制,建立SIIQR模型。在相应的数值实验中,可以发现在引入了隔离策略之后,感染主机的数量有了明显的下降,但是效果不是十分理想。为了增强对易感染主机的保护力度,引入虚拟补丁技术,从而在SIIQR模型的技术之上,建立SIIPQR模型。在引入虚拟补丁抑制策略之后,可以发现易感染主机有了良好的保护,从而降低了整个僵尸网络中感染主机的数量,达到了良好的抑制效果。此外,本文给出了三种模型的数值模拟,实验结果验证了相应的无病平衡点的存在,其值与理论推导一致。最后,本文对三种传播模型进行了离散时间型的仿真,将仿真曲线和数值曲线进行比较,两条曲线很好地吻合,验证了理论分析和数值模拟的正确性。
[Abstract]:With the rapid popularization of the Internet and the rapid development of related technologies, the Internet occupies a more and more important position in the process of people's work and life. At the same time, the problem of network security is becoming more and more serious. The frequency of network security incidents is increasing year by year. Among them, the emergence of P2P botnets, such as Storm, has attracted the attention of enterprises and researchers in the field of security. The traditional malware propagation model can not describe the spread process of the new P2P botnet well, but how to restrain the spread of this kind of botnet in the network effectively has become a very important problem. In the process of P2P botnet transmission, the infection of network host presents two stages: first, infected host, then infected host join botnet. In order to better suppress the spread of P2P botnet, this paper proposes a complete inhibition strategy, and establishes a comprehensive system of botnet detection, isolation, immunization, killing, virtual patch and other related inhibition technologies. To limit the spread of P2P botnets. The isolation strategy based on P2P system can effectively suppress the attack of infected host, while the virtual patch strategy will enhance the protection of vulnerable host. In the process of P2P botnet transmission, the infection of network host presents two stages. According to this characteristic, a P2P botnet two-stage infection transmission model-SIIR model is established to analyze and study the transmission characteristics of P2P botnet. Based on the SIIR model, a P2P isolation strategy based on intrusion detection system (IDS) is proposed to suppress the growth of infected hosts and suppress the spread of P2P botnet. The SIIQR model is established. In the corresponding numerical experiments, it can be found that after the introduction of isolation strategy, the number of infected hosts has a significant decline, but the effect is not very good. In order to enhance the protection of vulnerable hosts, virtual patch technology is introduced to build SIIPQR model based on the technology of SIIQR model. After the introduction of virtual patch suppression strategy, it can be found that the vulnerable host has good protection, thus reducing the number of infected hosts in the whole botnet and achieving a good inhibition effect. In addition, the numerical simulation of the three models is given. The experimental results show that the corresponding disease-free equilibrium points exist, and their values are in agreement with the theoretical derivation. Finally, three kinds of propagation models are simulated in discrete time mode, and the simulation curves and numerical curves are compared. The two curves are in good agreement with each other, which verifies the correctness of theoretical analysis and numerical simulation.
【学位授予单位】：东北大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】