Modeling and Simulation Study of the Propagation and Defense of Internet E-mail Worms
Modeling and Simulation Study of the Propagation and Defense of Internet E-mail Worms
复制标题
DOI：
10.1109/tdsc.2007.1001
复制
发表时间：
2007-04
影响因子：
7.3
通讯作者：
C. Zou;D. Towsley;W. Gong
中科院分区：
文献类型：
--
作者：
C. Zou;D. Towsley;W. Gong
由于许多人在工作和日常生活中依赖电子邮件通信，因此 Internet 电子邮件蠕虫构成了我们社会的主要安全威胁之一。与 Code Red 或 Slammer 等扫描蠕虫不同，电子邮件蠕虫通过电子邮件地址关系定义的逻辑网络传播，使得传统的流行病模型无法对电子邮件蠕虫的传播进行建模。此外，我们还表明 M. Boguna 等人提出的拓扑流行病模型。 （2000）由于其隐含的同质混合假设，很大程度上高估了拓扑网络中的流行病传播速度。为此，我们在本文中依靠模拟来研究电子邮件蠕虫的传播。我们提出了一个电子邮件蠕虫模拟模型，该模型考虑了电子邮件用户的行为，包括电子邮件检查时间和打开电子邮件附件的概率。我们对电子邮件列表的观察表明，互联网电子邮件网络在节点度方面遵循重尾分布，并且我们将其建模为幂律网络。为了研究拓扑影响，我们将幂律拓扑上的电子邮件蠕虫传播与其他两种拓扑（小世界拓扑和随机图拓扑）上的蠕虫传播进行了比较。幂律拓扑对电子邮件蠕虫传播的影响是复杂的：电子邮件蠕虫在幂律拓扑上比在小世界拓扑或随机图拓扑上传播得更快，但免疫防御在幂律拓扑上更有效。
As many people rely on e-mail communications for business and everyday life, Internet e-mail worms constitute one of the major security threats for our society. Unlike scanning worms such as Code Red or Slammer, e-mail worms spread over a logical network defined by e-mail address relationships, making traditional epidemic models invalid for modeling the propagation of e-mail worms. In addition, we show that the topological epidemic models presented by M. Boguna, et al. (2000) largely overestimate epidemic spreading speed in topological networks due to their implicit homogeneous mixing assumption. For this reason, we rely on simulations to study e-mail worm propagation in this paper. We present an e-mail worm simulation model that accounts for the behaviors of e-mail users, including e-mail checking time and the probability of opening an e-mail attachment. Our observations of e-mail lists suggest that an Internet e-mail network follows a heavy-tailed distribution in terms of node degrees, and we model it as a power-law network. To study the topological impact, we compare e-mail worm propagation on power-law topology with worm propagation on two other topologies: small-world topology and random-graph topology. The impact of the power-law topology on the spread of e-mail worms is mixed: E-mail worms spread more quickly on a power-law topology than on a small-world topology or a random-graph topology, but immunization defense is more effective on a power-law topology.