Along with the rapid development of social networks, social network worms have constituted one of the major internet security problems. The root of worm is the inevitable software vulnerability during the design and i...Along with the rapid development of social networks, social network worms have constituted one of the major internet security problems. The root of worm is the inevitable software vulnerability during the design and implementation process of software. So it is hard to completely avoid worms in the existing software engineering systems. Due to lots of bandwidth consumption, the patch cannot be transmitted simultaneously by the network administrator to all hosts. This paper studies how to prevent the propagation of social network worms through the immunization of key nodes. Unlike existing containment models for worm propagation, a novel immunization strategy is proposed based on network vertex influence. The strategy selects the critical vertices in the whole network. Then the immunization is applied on the selected vertices to achieve the maximal effect of worm containment with minimal cost. Different algorithms are implemented to select vertices. Simulation experiments are presented to analyze and evaluate the performance of different algorithms.展开更多
Greedy propagation policy for unstructured P2P worms employs the neighboring node list of each node in peer-to-peer （P2P） network to speed up the propagation of P2P worms. After describing the technique background o...Greedy propagation policy for unstructured P2P worms employs the neighboring node list of each node in peer-to-peer （P2P） network to speed up the propagation of P2P worms. After describing the technique background of P2P worms, the algorithm of greedy propagation is addressed. Simulating design for this novel propagation policy is also described. Then, the effects of the greedy propagation policy on spreading speed, convergence speed, and attacking traffic in static P2P worms are simulated and discussed. The primary experimental results show that the greedy propagation is harmful and can bring severe damages to P2P network.展开更多
In this paper, information theory and data mining techniques to extract knowledge of network traffic behavior for packet-level and flow-level are proposed, which can be applied for traffic profiling in intrusion detec...In this paper, information theory and data mining techniques to extract knowledge of network traffic behavior for packet-level and flow-level are proposed, which can be applied for traffic profiling in intrusion detection systems. The empirical analysis of our profiles through the rate of remaining features at the packet-level, as well as the three-dimensional spaces of entropy at the flow-level, provide a fast detection of intrusions caused by port scanning and worm attacks.展开更多
Internet worm is harmful to network security,and it has become a research hotspot in recent years.A thorough survey on the propagation models and defense techniques of Internet worm is made in this paper.We first give...Internet worm is harmful to network security,and it has become a research hotspot in recent years.A thorough survey on the propagation models and defense techniques of Internet worm is made in this paper.We first give its strict definition and discuss the working mechanism.We then analyze and compare some repre-sentative worm propagation models proposed in recent years,such as K-M model,two-factor model,worm-anti-worm model（WAW）,firewall-based model,quarantine-based model and hybrid benign worm-based model,etc.Some typical defense techniques such as virtual honeypot,active worm prevention and agent-oriented worm defense,etc.,are also discussed.The future direction of the worm defense system is pointed out.展开更多
The traditional network simulator has function and performance limitation when simulating Internet worms,so we designed the grid-based Internet worm behavior simulator (IWBS Grid).IWBS Grid makes use of the real Inter...The traditional network simulator has function and performance limitation when simulating Internet worms,so we designed the grid-based Internet worm behavior simulator (IWBS Grid).IWBS Grid makes use of the real Internet topology,link and routing information,and simulates the worm behavior at the packet event-driven level;and proposes a high-performance Internet worms behavior simulation platform by right of the grid computing capability,resource and task management,and so on.The experimental results show that IWBS grid surpasses the traditional simulator in simulating capability,and the technology to track the worm propagation in packet level can propose the valuable information for the further study on worms.展开更多
目前已有一些全球化的网络蠕虫监测方法,但这些方法并不能很好地适用于局域网.为此,提出一种使用本地网协同检测蠕虫的方法CWDMLN(coordinated worm detection method based on local nets).CWDMLN注重分析扫描蠕虫在本地网的行为,针对...目前已有一些全球化的网络蠕虫监测方法,但这些方法并不能很好地适用于局域网.为此,提出一种使用本地网协同检测蠕虫的方法CWDMLN(coordinated worm detection method based on local nets).CWDMLN注重分析扫描蠕虫在本地网的行为,针对不同的行为特性使用不同的处理方法,如蜜罐诱捕.通过协同这些方法给出预警信息,以揭示蠕虫在本地网络中的活动情况.预警信息的级别反映报警信息可信度的高低.实验结果表明,该方法可以准确、快速地检测出入侵本地网络的扫描蠕虫,其抽取出的蠕虫行为模式可以为协同防御提供未知蠕虫特征.通过规模扩展,能够实施全球网络的蠕虫监控.展开更多
利用云计算中的核心技术MapReduce,提出了一种在线社交网络(online social network,简称OSN)蠕虫的仿真方法.为了提高仿真精度,首先提出利用节点属性可调节的OSN有向图来描述蠕虫传播的各个过程.其次,利用运行在云环境中的多个Map函数和...利用云计算中的核心技术MapReduce,提出了一种在线社交网络(online social network,简称OSN)蠕虫的仿真方法.为了提高仿真精度,首先提出利用节点属性可调节的OSN有向图来描述蠕虫传播的各个过程.其次,利用运行在云环境中的多个Map函数和Reduce函数来实现对OSN蠕虫传播各个过程的仿真.在真实的大规模数据集上的仿真实验结果表明,提出的仿真方法不仅具有较强的可扩展性,同时也为相关领域的研究提供了一定的帮助.展开更多
基金supported by Fundamental Research Funds of the Central Universities under Grant no. N120317001 and N100704001Program for New Century Excellent Talents in University (NCET13-0113)+1 种基金Natural Science Foundation of Liaoning Province of China under Grant no. 201202059Program for Liaoning Excellent Talents in University under LR2013011
文摘Along with the rapid development of social networks, social network worms have constituted one of the major internet security problems. The root of worm is the inevitable software vulnerability during the design and implementation process of software. So it is hard to completely avoid worms in the existing software engineering systems. Due to lots of bandwidth consumption, the patch cannot be transmitted simultaneously by the network administrator to all hosts. This paper studies how to prevent the propagation of social network worms through the immunization of key nodes. Unlike existing containment models for worm propagation, a novel immunization strategy is proposed based on network vertex influence. The strategy selects the critical vertices in the whole network. Then the immunization is applied on the selected vertices to achieve the maximal effect of worm containment with minimal cost. Different algorithms are implemented to select vertices. Simulation experiments are presented to analyze and evaluate the performance of different algorithms.
基金supported by the National Natural Science Foundation of China under Grant No. 60873075
文摘Greedy propagation policy for unstructured P2P worms employs the neighboring node list of each node in peer-to-peer （P2P） network to speed up the propagation of P2P worms. After describing the technique background of P2P worms, the algorithm of greedy propagation is addressed. Simulating design for this novel propagation policy is also described. Then, the effects of the greedy propagation policy on spreading speed, convergence speed, and attacking traffic in static P2P worms are simulated and discussed. The primary experimental results show that the greedy propagation is harmful and can bring severe damages to P2P network.
文摘In this paper, information theory and data mining techniques to extract knowledge of network traffic behavior for packet-level and flow-level are proposed, which can be applied for traffic profiling in intrusion detection systems. The empirical analysis of our profiles through the rate of remaining features at the packet-level, as well as the three-dimensional spaces of entropy at the flow-level, provide a fast detection of intrusions caused by port scanning and worm attacks.
基金supported by the Research Fund for the National Committee of China under Grant No. 05XN09
文摘Internet worm is harmful to network security,and it has become a research hotspot in recent years.A thorough survey on the propagation models and defense techniques of Internet worm is made in this paper.We first give its strict definition and discuss the working mechanism.We then analyze and compare some repre-sentative worm propagation models proposed in recent years,such as K-M model,two-factor model,worm-anti-worm model（WAW）,firewall-based model,quarantine-based model and hybrid benign worm-based model,etc.Some typical defense techniques such as virtual honeypot,active worm prevention and agent-oriented worm defense,etc.,are also discussed.The future direction of the worm defense system is pointed out.
基金Sponsored by the National High Technology Research and Development Program of China (Grant No. 2007AA010503)the Science and Technology Development Program of Weihai (Grant No. 2007-96)the Science Foundation of HIT at Weihai (Grant No. HITWH 200702)
文摘The traditional network simulator has function and performance limitation when simulating Internet worms,so we designed the grid-based Internet worm behavior simulator (IWBS Grid).IWBS Grid makes use of the real Internet topology,link and routing information,and simulates the worm behavior at the packet event-driven level;and proposes a high-performance Internet worms behavior simulation platform by right of the grid computing capability,resource and task management,and so on.The experimental results show that IWBS grid surpasses the traditional simulator in simulating capability,and the technology to track the worm propagation in packet level can propose the valuable information for the further study on worms.
文摘目前已有一些全球化的网络蠕虫监测方法,但这些方法并不能很好地适用于局域网.为此,提出一种使用本地网协同检测蠕虫的方法CWDMLN(coordinated worm detection method based on local nets).CWDMLN注重分析扫描蠕虫在本地网的行为,针对不同的行为特性使用不同的处理方法,如蜜罐诱捕.通过协同这些方法给出预警信息,以揭示蠕虫在本地网络中的活动情况.预警信息的级别反映报警信息可信度的高低.实验结果表明,该方法可以准确、快速地检测出入侵本地网络的扫描蠕虫,其抽取出的蠕虫行为模式可以为协同防御提供未知蠕虫特征.通过规模扩展,能够实施全球网络的蠕虫监控.
文摘利用云计算中的核心技术MapReduce,提出了一种在线社交网络(online social network,简称OSN)蠕虫的仿真方法.为了提高仿真精度,首先提出利用节点属性可调节的OSN有向图来描述蠕虫传播的各个过程.其次,利用运行在云环境中的多个Map函数和Reduce函数来实现对OSN蠕虫传播各个过程的仿真.在真实的大规模数据集上的仿真实验结果表明,提出的仿真方法不仅具有较强的可扩展性,同时也为相关领域的研究提供了一定的帮助.
