Modeling and analysis of Internet worm propagation

作     者：SU Fei LIN Zhao-wen MA Yan 

作者机构：Institute of Networking Technology Beijing University of Posts and Telecommunications Beijing 100876 China Beijing Key Laboratory of Intelligent Telecommtmications Software and Multimedia Beijing University of Posts and Telecommunications Beijing 100876 China 

出 版 物：《The Journal of China Universities of Posts and Telecommunications》 (中国邮电高校学报（英文版）)

年 卷 期：2010年第17卷第4期

页      面：63-68页

核心收录：

学科分类：0810[工学-信息与通信工程] 1205[管理学-图书情报与档案管理] 12[管理学] 1201[管理学-管理科学与工程(可授管理学、工学学位)] 0839[工学-网络空间安全] 08[工学] 0811[工学-控制科学与工程] 081201[工学-计算机系统结构] 0812[工学-计算机科学与技术（可授工学、理学学位）] 

基　　金：supported by the Ministry of Education Science and Technology Basic Resource Data Platform (507001) the Ministry of Education Research Project for Returned Talents after Studying Abroad,and the Chinese Universities Scientific Fund (2009RC0502) the International Scientific and Technological Cooperation Program (S2010GR0902) 

主　　题：worm propagation model TLWM NAT 

摘      要：Although the frequency of Internet worm＇s outbreak is decreased during the past ten years, the impact of worm on people＇s privacy security and enterprise＇s efficiency is still a severe problem, especially the emergence of botnet. It is urgent to do more research about worm＇s propagation model and security defense. The well-known worm models, such as simple epidemic model （SEM） and two-factor model （TFM）, take all the computers on the internet as the same, which is not accurate because of the existence of network address translation （NAT）. In this paper, we first analyze the worm＇s functional structure, and then we propose a three layer worm model named three layres worm model （TLWM）, which is an extension of SEM and TFM under NAT environment. We model the TLWM by using deterministic method as it is used in the TFM. The simulation results show that the number of NAT used on the Internet has effects on worm propagation, and the more the NAT used, the slower the worm spreads. So, the extensive use of NAT on the Internet can restrain the worm spread to some extent.