基于蜜罐识别的僵尸网络多时区改进扩散模型

摘要

针对当前僵尸网络模型化工作尚不成熟的现状,比较分析了双阶段智能僵尸网络传播模型与多时区僵尸网络传播模型的优劣点,提出了一种基于蜜罐识别技术的改进型智能僵尸网络时空传播扩散模型.该模型基于双阶段蜜罐探测技术,引入时区因素,对多时区白昼交替导致的扩散传播参数进行了差异化分析,同时研究了不同时区离线主机数和修复率对僵尸网络传播的影响.通过仿真实验结果表明,该模型相对于传统的僵尸网络传播模型能更高效地描述僵尸网络在实际多时区网络中的扩散行为.%Aimed the current state of Botnet modeling immature, comparison and analysis between two-stage advanced botnet propagation modeling and multi-time zones botnet modeling are made, and an improvement intelligent model using time zones for honeypot-awared advanced Botnet is proposed. The model is based on two-stage honeypot-awared process and considered the time zones factor, then the differentiation analysis on propagation rate parameter result from the diurnal properties of multi-time zones is given. Meanwhile, the impact on the Botnet propagation under the number of offiine computers and recovery rates in different time zones is studied. Finally,with the comparison to the traditional spreading model, this improved model is able to more effectively depict the Botnet propagation in real network by simulation.