【作者】 谭文元；

【导师】 陈伟；

【作者基本信息】 浙江师范大学 ， 计算机软件与理论， 2010， 硕士

【摘要】 随着网络在社会生活中占据越来越重要的地位,恶意蠕虫的危害影响越来越严重,其对社会造成的危害影响程度大大超越传统的病毒。但是传统的对抗恶意蠕虫的安全技术对之已经不适应,要使恶意蠕虫的传播扩散得到基本控制,需要采用不同于以往的针对单个恶意蠕虫进行防治的方法,因为恶意蠕虫种类成千上万,且每种又衍生许多变体,更甚的是,恶意蠕虫编写者越来越采用人工智能技术使恶意蠕虫得到更好的隐蔽。所以,针对恶意蠕虫的研究刻不容缓,且只有在技术上走在其前面,才能当相关的恶意蠕虫出现时,对其进行有效防治。而在恶意蠕虫的防治方面,良性蠕虫的研究较少。尤其是针对良性蠕虫的传播扩散方面,大多研究没有考虑良性蠕虫在对抗恶意蠕虫的过程中对网络系统和用户系统的影响。因此研究良性蠕虫的扩散传播和资源占用在恶意蠕虫防治方面具有积极的理论意义和实践参考价值。本文的研究工作主要集中于以下方面：1、首次对被良性蠕虫渗透的主机进行分类：被渗透类主机和探测类主机,从而为减少良性蠕虫扩散过程中产生的网络通信量提供了新的视角。2、提出了反馈式的轮转探测扩散模型以及基于B+地址树(BAT)的扩散算法。并且对扩散算法进行了仿真和对比测试。仿真结果显示：根据恶意蠕虫的疫情和应用需求,良性蠕虫可以选择不同的探测主机数进行扩散。对比测试显示：在探测主机数达到预设值后基于BAT的扩散算法网络通信量一直处于平稳状态,且相比基于ET扩散算法的网络通信量要小。3、设计和实现了一个用于支持本文扩散模型的基于xml的应用层网络协议和良性蠕虫系统,并且进行了测试,结果表明：基于xml的应用层网络协议在良性蠕虫扩散过程中能够很好地被解析,对本文扩散模型起到了支撑作用,且良性蠕虫交互流程设计思路符合实际情况也满足本文的要求。4、设计和实现了数据隐藏功能。暂时需要的数据可以进行隐藏,减少了对用户系统的资源占用。更多还原

【Abstract】 As the network plays a more and more important part in the social life, the malicious worm does more harm to our life than traditional virus. But, traditional security technologies can’t deal with malicious worms well any more, in order to make the spread of a malicious worm spreading under control, we need to take method which is different from the past method that carried out only to prevent a single malicious worm, as we know there are thousands of types of malicious worm, and each type worm can derive many variants, and even more, the malicious worm writers are using artificial intelligence to make the malicious worms to be hidden better. the research about malicious worms is needed urgently, and only we prepare well in technology, effective prevention and treatment can be adopted to deal with the malicious worms.There is few studies on benign worms for the preventive treatment of malicious worm, and most studies on benign worms do not consider the influence to the network system and user systems that the benign worm made in the process of fighting against malicious worms. So the study of proliferation and resources to take up of the benign worm there is positive theoretical and practical reference value for preventive treatment of malicious worm.The contribution of this article is as follow:Fisrtly, classifying the computers infected by benign worm to infected computer and scanning computer, which offers another viewpoint for reducing network flux in the proliferation of benign worm.Secondly, proposed a rotating scanning model based on feedback and a propagation algorithm based on B+ Address Tree(BAT). Simulated the propagation algorithm and compared it to the propagation algorithm based on Exponential Tree(ET). The result of simulation turns out that according to the malicious worm propagation in, we can choose different number of the scan hosts to spread benige worm. The result of the comparison demonstrates after the number of scan host attained the given number the network flux of the algorithm based on BAT is stable and was less than that of the algorithm based on ET.Thirdly, design and implement an application layer network protocol, which can be adopted to the model of the article, and a benign worm system, then test them. The results of these tests turn out the network protocol can be resolved correctly and can support the model very well and the design about the interactive process about benign worm system accorded with the fact and met the article.Lastly, Design and implement a data hiding feature. The temporary needed data can be hidden, which can reduce occupancy of the user’s system resources.更多还原