網路蠕蟲傳播防治之研究

Research on Defending Network Worm Propagation

李維哲(Wei-Che Li)

指導教授 ： 王振興 ； 王永鐘

國立臺北科技大學/機電學院/電機工程系所/碩士(2005年)

摘要

基於網際網路的快速發展和電腦主機存在的漏洞(vulnerabilities)逐年增加，網路蠕蟲(network worm)對網路的威脅日益升高。網路蠕蟲帶來的災害，不僅僅是利用電腦主機存在的特定漏洞來植入木馬(Trojan horse)或後門程式(backdoor)，企圖對遠端電腦的遙控或是資料竊取；網路蠕蟲在進行獨立地大規模傳播時所帶來的網路擁塞，更讓企業和政府損失慘重。
本論文使用開放原始碼(open source code)的SSFNet網路模擬器模擬本校校園網路遭受網路蠕蟲傳播攻擊的情形，進而提出防治的方法。防治的方法是希望在網路蠕蟲進入校園網路感染電腦主機時，位於骨幹網路的各個第三層交換器(layer 3 switch)收集其子網路受感染主機的台數，並藉此選擇適合的阻斷門檻值和阻斷間隔時間，進行定時且循環的阻斷子網路動作來減緩蠕蟲的持續擴散，以阻止校園網路受感染主機進一步感染網路上其它的主機。由模擬結果可知，本論文提出的防治方法確實能減緩蠕蟲的擴散。

關鍵字

惡意軟體 ； 漏洞 ； 網路蠕蟲 ； 電腦病毒 ； SSFNet網路模擬器

並列摘要

Due to the rapid growth of Internet and the vulnerabilities existed in hosts increasing recently, the threats from network worms are rising gradually. Disasters that brought by the network worms not only cause the remote computers which have been embedded Trojan horse or backdoor being controlled by hackers for stealing some secret information but also cause network congestion.
In 2001, while CodeRed worms spread out, information security experts began a serious studies and research works on network worms. In this paper, we adopt open source code network simulator, SSFNet, to simulate and analyze network worms' infection pattern in campus network, and then propose a prevention method for their propagation. By reporting the number of infection hosts, which are collected by layer-3 switches in campus backbone network, the scheme will choose proper cutting threshold and cutting time interval for executing periodical block to the subnets to prevent unceasing infections to the other hosts. From the simulation results, this proposed method can certainly alleviate network worms' spread out.

並列關鍵字

Malware ； Vulnerabilities ； Network worm ； Computer virus ； SSFNet

參考文獻

[42] 袁勤國、李秋華，「校園網路安全防護機制之建立」，網際網路技術學刊，第四卷，第二期，2003，第99-104頁。

[46] 賴守全、謝木政、郭文曲，「校園網路安全事故自動防治系統之設計與實作」，網際網路技術學刊，第四卷，第二期，2003，第119-125頁。

[64] L. Breslau, D. Estrin, K. Fall, S. Floyd, J. Heidemann, A. Helmy, P. Huang, S. McCanne, K. Varadhan, Y. Xu, and H. Yu, "Advances in Network Simulation," IEEE Computer, vol. 33, No. 5, May 2000, pp. 59-67.

[75] J. H. Lee, E. G. lm, J. B. Yun, and S. K. Park, "Network Intrusion and Defense Simulation Framework based on SSFNet," Proceedings of 6th International Conference on Advanced Communication Technology (ICACT’04), vol. 1, 2004, pp. 213-217.

[4] (Online Source) Scalable Simulation Framework, http://www.ssfnet.org/.