Modeling and Analyzing Passive worms over Unstructured Peer-to-Peer
Networks
Fangwei Wang1, Yunkai Zhang2, Jianfeng Ma1
(Corresponding author: Fangwei Wang)
Ministry of Education Key Lab of Computer Networks and Information Security, Xidian University, Xi’an
710071, China. (Email: [email protected], [email protected]) 1
Network Center, Hebei Normal University, Shijiazhuang 050016, China. ([email protected]) 2
Abstract
Passive worm, which is one of the major forms of
1
Introduction
peer-to-peer (P2P) worm, have posed serious
Unstructured Peer-to-Peer (P2P) overlay networks
security threats to the functioning of unstructured
are distributed systems in nature, without any
P2P networks. A delayed SEIRS epidemic model
hierarchical organization or centralized control [1].
with death, offline and online rate is constructed
Each peer is a client as well as a server, hereinafter
based on the actual situation of P2P users. The basic
called a Servent. All peers play the same role in logic
reproduction number that governs whether a passive
instead of in the function. Unstructured P2P
worm is extinct or not is obtained. In this model, time
networks provide P2P worms some facilities to
delay consists of latent and temporary immunity
propagate, although they can decrease reliability and
periods. The impact of different parameters on this
search capabilities, and increases network traffic.
model is studied with simulation results, especially
P2P
worm
is
formally proposed
in
the
the effect of time delay, which can provide an
International Conference IPTPS 2005 [2] and their
important guideline in the control of unstructured
tremendous harm to network security have aroused
P2P networks as well as passive worm defense.
widespread concerns in the community. P2P worms
Finally, some future work has been introduced.
are malicious codes over a P2P network by
Keywords: peer-to-peer networks; passive worms;
exploiting vulnerabilities in popular applications and
basic
reproduction
number;
equilibrium;
protocols. Several reasons make P2P worms
propagation model
potentially be faster and more furtive than traditional
scanning worms. Firstly, the efficiency of locating a
avoid some detection methods, such as Virus
vulnerable host is high, and they do not waste time
Throttle. In this paper, we focus mainly on passive
probing host with vulnerabilities. Secondly, the P2P
worms.
software may contain vulnerabilities which could be
Modeling passive worms is useful to understand
exploited by attackers. Thirdly, P2P softwares are
how particular factors can affect their propagation. It
generally not blocked by the firewall because they
also helps in studying the effectiveness of some
make common outgoing connections to other clients.
methods of worm detection and containment, and
Once an outgoing connection is made, a server can
finding the optimal application of these solutions that
pass files to the client. How to effectively defend
permits to fight passive worms effectively. Some
against P2P worms and decrease the harms caused by
epidemiological models have been proposed to study
them has been a key problem of domestic and foreign
the propagation of scanning strategy-based worms
scholars facing. According to the difference of
and local subnet scanning worms [4, 5]; however,
finding targets and execution, P2P worms can be
they can not be used to model passive P2P worms,
divided into three categories [3]: passive worm,
because of the particular characteristics of passive
reactive worm, and proactive worm. Passive worms,
P2P worms’ propagation. Therefore, new studies
such as Benjamin, Bare, Duload, attach themselves
have been carried out to model passive P2P worms’
to shared files and propagate as these files are
propagation. In the following, we describe some of
downloaded and executed on other hosts; Reactive
the proposed models.
worms that only propagate with legitimate network
The issue of worms in peer-to-peer is addressed
activities instead of embedded into sharing files can
wherein the authors perform a simulation study of
avoid some detection methods available based on
dangers posed by P2P worms and proceed to outline
abnormal traffic, such as Gnuman worm; and
possible mitigation mechanisms [2]. The authors
proactive worms automatically connect to and infect
point out that P2P worm can stealthily propagate
known peers using topological information so that
through the overlay topology and invalidate
numerous defending mechanisms aiming at scanning
model proposed by Cliff C.Z, Hanxun Zhou et al. [9]
worms. Moreover, they obtain the upper bound of the
take into account the effect of the time delay, and
number of infected host. However, Zhou L et al do
present a propagation model for passive worms.
not take into account the effect of the node position
Thommes R et al. [10 use an analytical model to
on the worm propagation. Guanling C et al. [3]
assess the impact of a detection solution (Credence)
provide a workload-driven simulation framework to
on the P2P worm propagation, and to determine
characterize three types of non-scanning worms and
approximately how widespread the Credence system
identify
their
must be so as to combat the worm efficiently.
propagations, which states that the type of worm that
Richard W.T et al. [11] propose an improved SEI
would spread over such a network would not be
(Susceptible- Exposed-Infected) model to simulate
detected by many of current methods. Andrew K et
virus propagation. However, they do not show the
al. [6] point out the fact that 68% of the executable
length of latency and take into account the impact of
files contain passive worms through months of data.
anti-virus software. The model (SEIR) proposed by
XIA CH et al. [7] present epidemic models of P2P
the authors [12] assumes that recovery hosts have a
worms in three typical structured P2P networks,
permanent immunization period with a certain
outline the worms’ rapid spreading capability and
probability, which is not consistent with real
reveal the negative influences of overlay topologies
situation. In order to overcome limitation, Bimal
on the worms’ propagation. Krishna R et al. [8] give
K.M et al. [13] present a SEIRS model with latent
a model for Gnutella-type P2P systems by addressing
and temporary immunity periods, which can reveal
a parameter (TTL), and consider the possible victims
common worm propagation. Due to the fact that it
of an infected peer are limited to those which are
does not take into account the real situation of
TTL hops away from it and not the whole P2P
end-users, the model is also not be used to simulate
network. The introduction of such a characteristic
passive worms over unstructured P2P networks.
the
parameters
influencing
would avoid false positives. Based on the two-factor
An important omission of work available is the
effect of network throughput. Modeling the
(1)The total number of peer population N(t) is a
propagation of passive worms, the authors assume
variable changing with time t. In other words, peers
that a vulnerable peer can be infected in a unit time.
can join or leave P2P networks. The online rate b and
This assumption is certainly not accordant to the
offline rate  are constants.
reality since the average file is 4MB [15], whereas,
(2)The total population is partitioned into four
average bandwidth per peer is 132KBps [16], which
compartments: the susceptible compartment (S), the
neglects the diversity of file size in the shared
exposed compartment (E), the infected compartment
folders. As a result, the downloading time is not a
(I), and the recovered compartment (R). Each peer
negligible factor, which has a significant effect on
can only be in a state, and the infected peer can not be
the simulating the passive worms propagation. Thus,
infected again.
inspired by the reference [13], we propose a new
(3)The latency period  is a variable related to the
delayed SEIRS epidemic mathematically-based
downloaded file size; moreover, the immunity period
model accounting for the effect of network
is a constant related to the anti virus software.
throughput based on the actual situation of P2P end
users.
2
(4)The waiting time of the exposed, infected and
recovered compartment is an exponent distribution.
Propagation Model for Passive Worms
(5)When a peer is removed from the infected class,
it obtains temporary immunity with probability p and
2.1 Model Assumptions
died from the attack of passive worms with
From the real P2P networks, passive worms must
probability (1-p).
spend some time on propagating from the infected
From the assumptions above, the standard
hosts to the susceptible ones due to the effect of
incidence of the total variable population size can be
current network throughput. We make some
expressed as
assumptions in order to concisely and accurately
reflect the propagation behaviors of passive worms.
N(t)=S(t)+E(t)+I(t)+R(t)
(1)
Table1 lists parameters and notations needed in
this paper.
Table 1 Parameters and of notations in this paper
Parameter
S(t)
E(t)
I(t)
R(t)
b, μ, ε, α
ω,τ
γ1
γ2

p
TTL
bw, s, m
Notation
Number of susceptible peers at time t
Number of exposed peers at time t
Number of infected peers at time t
Number of recovered peers at time t
Per peer online rate, offline rate, death
rate, recovery rate, respectively
The latency and temporary immunity,
respectively
Rate at which peers terminate ongoing
downloads
Rate at which peers renew interest in
downloading a file after having deleted
it
Rate at which a peer generates queries
Probability of temporary immunity
acquired when a peer is recovered from
the infected class
Number of hops a query can reach
Average bandwidth of all peers, size
and the number of chunks of sharing
files, respectively
discarded. Due to the fact that Gnutella, Kazaa
networks follow a power-law degree distribution
[14], we use the generating function [14] to quantify
the number of peers available while searching for the
file. Define the generating function for vertex degree
probability distribution as

G0 ( x)  k 0 p k x k
(2)
Where p k is the probability that a randomly
selected vertex on the network has degree k, which is
given
by
the
following
equation pk  Pr ( N  k )  Ck  , where C and  are
constant. The query is used to reach a recursive
definition for the k-hop neighbors of a node in the
2.2 Propagation Model for Passive worms
network. Because an edge is chosen at random, it is
In order to clearly understand the propagation
more likely that it leads to a node with a higher
process of passive worms, we first study the search
degree. The generating function for the probability
mechanisms adopted by some P2P networks, such as
distribution of reaching a k degree node by traversing
Gnutella. Among search mechanisms available,
a randomly chosen edge can then be obtained as
flooding method is the most popular. Peer A sends
out a query for an expected file to all its neighbors.
k kpk x k
k kpk

xG0' ( x)
G0' (1)
(3)
Peer B receiving such a request first check its local
The distribution of the outgoing edges from the
shared folder, and responds this request if possessing
vertex chosen has one power of x lesser then the
the file and then check the hop count of the query. If
expression (3) and can thus be expressed as
the value is greater than zero, it will forward the
query to its neighbors; otherwise, the query is
G1 ( x)  G0' ( x) / G0' (1) .
In a similar fashion, the
generating function for the number of two-hop
Suppose the file has s bits and each peer has a limited
neighbors is k p k [G1 ( x)] k  G0 (G1 ( x)) . As a result,
download capacity, say bw bps. For simplicity, we
the recursive formulation for the distribution of the
assume that N= Zavk users wish to obtain the expected
number of m-hop neighbors is expressed by the
file which is initially available at one peer. As a
following equation G0(G1(…G1(x)…)), which can be
result, we can obtain the following Lemma 1 about
given as
the average delay for all peers in the whole
G
( m)
G0 ( x)

( x)   ( m1)

(G1 ( x))
G
m 1
m2
transmitting process.
(4)
Lemma 1: For the number of peers N, the average
Through differentiating the generating function
delay for peers is = logZavN at least, where=s/bw.
and substituting x=1, we can obtain the average
Proof. From above hypothesis, we can obtain that Ns
number of one and two hop neighbors of a peer
bits are required to be exchanged in order to serve N
which are given by Z 1  G0' (1)  k kpk and Z 2  G0'' (1)
requests. It is clear that a good dissemination strategy
respectively. Similarly, the number of m-hop
is to first serve Zav users at rate bw, at which point the
neighbors can be expressed as Zm=Z1(Z2/Z1)m-1.
service capacity grows to bw(Zav+1)  bZav, and then
Consequently, the average number of search
have Zav peers serve remnant peers, until the N users
neighborhood of a peer during TTL hop is obtained
are served. Under this idealized strategy, peers can
as
complete service every =s/bw seconds, at which
(5)
point there are an exponential growth of Zavt/ in the
Due to the restriction of network bandwidth, the
number of peers available to serve the file. If the
time taken a file be simultaneously downloaded by
network follows these dynamics the N peers will be
multi-peers is different to single peer. Now, we study
served by time logZavN+1=k. As a result, the
the average time. Let the number of peers in a
average download delay  experienced by peers can
large-scale unstructured P2P network be fixed at N,
be computed as follows. Let j denote the delay
and a limited number of peers, say 1, can serve them.
experienced by the jth peer to complete, and note that
Z av  i 1 Z i
TTL
Zav(i-k)N peers complete service at time (i+1), thus,
the ith Chunk. Now consider the (k+1)th time slot.
an average delay for peers is
Suppose the peers in A1 send chunk 1 to the N/Zav

1
N
k 1
 j 1 j  i 0 Z avi  k (i  1)  k 
N
N 1

N
peers that have not yet received it. Meanwhile the
peers in Ai (i>1), send Chunk i to a node in A1
  (log Z av
N 1
N
)   log Z av N .
N
choosing a peer that has at this point only received
In some networks (such as eDonkey), multi-part
Chunk 1. This process continues until all chunks are
downloads strategy is utilized in order to improve the
eventually delivered to all peers by time slot
downloading speed. Suppose the file is divided into
k+m=(/m)(logZav(N-1)+m). Because N/Zav peers have
m chunks of identical size. In the following, we study
received all chunks when Chunk m-1 completes
its average delay for peers under this scenario.
duplication across all peers at time slot k+m-1 and
Lemma 2: For the number of peers N, the average
the rest ones will receive Chunk m during the last
delay for peers for downloading a big file (m chunks)
time slot k+m, thereafter the average delay
is =(/m) logZavN at least, where=s/bw.
experienced by peer can be expressed as follows.
Proof. When a peer has finished downloading a
 ( m) 
file chunk, it can start to server it. To illustrate this

idea consider the following idealized strategy. We
1
N

m
1

 j 1  (jm)  2 (( k  m  1)  (k  m)) m
N
(log Zav N 
2m  1 
)  log Zav N .
2
m
From Lemma 2, we can obtain that the larger m is,
shall track service completions in time slots of size
the smaller the average delay for the downloading
s/mbw=/m. We suppose that the source of file sends
process is.
Chunk 1 to a peer, Chunk 2 to another peer, and so on
until it finishes disseminating the last Chunk m on
slot m. Meanwhile each Chunk i is being duplicated
in the network. Then at time k slot, the N peers can be
partitioned into k sets Ai, i=1,2,…,k, with | Ai |= Zavk-i,
and Ai corresponds to peers which have only received
On the other hand, anti virus software can provide
a temporary immunity with time  instead of
permanent immunity.  is governed by the version
and virus database of anti virus software. The
temporary immunity period  may get long if the anti
virus software is often updating.
From the model assumptions in Section 2.1, we can
obtain that the number of infected peers at time t is
the number of exposed ones (
Z av S (t   ) I (t   )
N (t   )
) at
time t-. Due to the offline of some peers, the
Z av S (t ) I (t )
 dS (t )
  2 R(t )  I (t   )e     1E (t )
 dt  bN (t )  uS (t ) 
N
(
t
)

 dE (t ) Z S (t ) I (t ) Z S (t   ) I (t   )e  

 av
 av
 E (t )   1E (t )
N (t )
N (t   )
 dt
(6)

 dI (t ) Z av S (t   ) I (t   )e  

 I (t )  I (t )  I (t )

N (t   )
 dt
 dR(t )
 pI (t )  I (t   )e     2 R(t )  R(t )

 dt
From Equation (1) and (6), we can get
probability of infected peers that are still online is
e- from time t- to t. Using the same procedure
and assumption, we can obtain that the number of
dN(t)/dt=(b-μ)N(t)-(b-(1-p)α)εI(t)
For the continuity of the precondition, we require,
E (0) 
peers from the recovered class to the susceptible
class isαI(t-), and the probability is e- from time
t- to t.
0

Z av S (u ) I (u )
N (u )
eu du
R(0) 
0
 pI (u)e
u
du
2.3 Model Analysis
We do some transforms because of the denominators
containing variables. Define
As a result, the population transfer among
compartments is schematically depicted in the
transfer diagram in Figure 1.
s(t)=S(t)/N(t),
e(t)=E(t)/N(t),
i(t)=I(t)/N(t),
r(t)=R(t)/N(t), then the Equation (6) can be expressed
as Equation (7)
t
 ds(t )
 dt  b  m(t ) s (t )  Z av s (t )i(t )   2 r (t )  i(t   ) exp(  t  m(q)dq)   1e(t )

 de(t )  Z s (t )i(t )  Z s (t   )i(t   ) exp(  t m(q)d q)  m(t )e(t )   e(t )
av
av
1
t 
 dt

t
 di(t )  Z s (t   )i(t   ) exp( 
m(q)d q )  m(t )i(t )  I (t )  I (t )
av
 dt
t 
 dr (t )
t

 pi(t )  pi(t   ) exp( 
m(q)dq)   2 r (t )  m(t )r (t )
 dt
t 




Figure 1 The structure of compartments
(7)
Where m(t)=b-(b+(1-p))i(t) , and
We can obtain the following SEIRS model
according to the modeling idea of the epidemic
dynamic compartments.
1=s(t)+e(t)+i(t)+r(t).
Let S(t), E(t), I(t), R(t) be the solution of Equation
(6). The s(t), e(t), i(t), r(t) is the solution of (7) with
0
0

u
e(0)   Z av s(u)i(u) exp(  m(q)dq)du ,
0
0

u
r (0)   pi(u) exp ( m(q)dq)du . If s(t) and i(t) are
3
positive on the initial interval, then s(t) and i(t) are
In this section, we provide some examples of passive
positive for all finite t 0.(corollary 2.1 [17].)
worms behaviors in unstructured P2P network
It
is
easy
to
Y={(s(t),e(t),i(t),r(t))|
check
that
the
region
s(t),e(t),i(t),r(t) ≥ 0
and
Performance Evaluation and discussions
predicted by our model, and study the effect of some
parameters.
s(t)+e(t)+i(t)+r(t)=1} is a positive invariant set of
3.1 Simulation Model
Equation (8). We consider the passive worm free
The network used for simulations consists of
equilibrium. When the infected fraction i=0, then
30,0000 peers. The network is growing using the
e=r=0, and s=1. This is the only equilibrium on the
methodology proposed by Holme [18]. This ensures
boundary of Y. According to reference [13], we have
that the peer degree follows a power law distribution
the following threshold for the existence of the
and the network has a high clustering coefficient.
interior equilibrium: R0=(Zave-)/(b+++1+2).
The average peer degree and the exponent of power
The threshold R0 is also called the basic reproduction
law of the network are 4.5 and 3.4, respectively,
number. When R0 is smaller than 1, the equilibrium
which are close to the real values of Gnutella
is globally stable, and the worm gradually disappears. network as measured in [3,16].
When R0 is larger than 1, the worm will
Performance
metrics:
the
system
attack
quantity
performance is defined as follows: the time taken t
1/(b+++1+2) is the average waiting time in the
(X axis) to infected peer numbers (Y axis).
infective class. For (Zav)<(b+++1+2), the
Evaluation systems: a tuple: <TTL, s, m, p, τ> is used
solutions of Equation (9) approach the passive worm
to represent the configuration parameters. As we
free equilibrium as (t) [17].
focus mainly on selected important parameters that
exponentially
propagate.
The
are sensitive to the propagation of passive worms,
the following parameters are set as constant values
(I(0)=1, s=4000KB, bw=132KBps, ε=0.01, b=0.04,
μ=0.03, α=0.2, λ=0.001, γ1=0.005, γ2=0.001.) in all
observations: the number of hops (TTL) plays an
simulations. The size of average files s and average
important role in the propagation of passive worm.
bandwidth available bw is the same to the real P2P
The larger TTL is, the more rapid the passive worm
networks. Evaluation method: we use numerical
propagates. It is easy to understand that a peer may
analysis of the differential equations by using Matlab
locate more peers during the search process, and the
Simulink to obtain performance data.
probability of finding an infected peer becomes
The basic reproduction number R0 is 0.4436
larger with the increase of TTL. Thereafter, once a
(TTL=2, s=4000KB) through the calculation. The
peer is infected, the passive worm will propagate
passive worm will gradually disappear from the
rapidly. The tendency of the passive worm
theory. Next we will validate the conclusion by the
propagation in figure 2 is degressive, which is
use of some experiments.
consistent with the theory analysis.
3.2 Performance Results
In this subsection, we report the performance results
of propagation model along with observations.
Figure 3 Effect of file size
Figure 3 shows the data on the performance
sensitivity to different file size. The general system is
Figure 2 Effect of number of hops
configured
as
<2,*,1,0.4,50>
and
s
∈
Figure 2 shows the data on the performance
{2000,4000,8000}. From figure 3, we make the
sensitivity to different TTL. The general system is
following observations: the sharing file size s has a
configured as <*, 4000, 1, 0.4, 50> and TTL ∈
larger impact on the passive worm. Along with the
{1,2,3}. From figure 2, we make the following
increase of s, the time of reaching its peak decreases.
However, the number of infected peers is obviously
users wish to obtain a high-speed and low delay
small. As a result, sharing some big files (without
communication. However, the early designers do not
chunks) as soon as possible is a simple and efficient
adequately
method.
Consequently, the propagation speed of passive
consider
these
security
factors.
worms is also increased with the increase of the
transmission of sharing files. To guarantee a
sustained, healthy and stable development of P2P
networks, the designers need to take a tradeoff with
the efficiency and security.
Figure 4 Impact of number of Chunks
Figure 4 shows the data on the performance
sensitivity to different chunks m. The general system
is configured as <2,*,*,0.4,50>, s=80000KB, and m
∈ {1,5,10,20,25}. From figure 4, we make the
following observations: although the time of
Figure 5 Impact of temporary immunity probability
reaching the peak decreases, the peak has no obvious
Figure 5 shows the data on the performance
change (m=5,10,20,25). Unfortunately, when m=1,
sensitivity to temporary immunity probability p. The
the passive worm infects much larger peers than
general system is configured as <2,4000,1,*,50>, and
other values. Under the same assumptions, we can
p ∈{0.1,0.5,0.8,0.9}. Figure 5 shows the following
draw the conclusions from figure 2-4: a larger TTL, a
observations: a large p results in the decrease of
smaller sharing file embedded passive worms and a
infected peers and much larger time to eradicate
larger number of chunks result in the increase of
passive worms. This is mainly due to the fact that the
propagation
number of recovered class becomes large with
speed.
Under
the
common
circumstances, the designers of P2P networks and
increase of p.
governed by the number of hops, the size and the
number of chunks of sharing files and the temporary
immunity period. As a result, in order to effectively
defend against passive worms, we must restrict the
hops in configuring P2P systems, share large files as
Figure 6 Impact of temporary immunity period
soon as possible, and update anti virus software in
Figure 6 shows the data on the performance
time. This can provide an important guideline in the
sensitivity to different temporary immunity period τ
control of unstructured P2P networks as well as
(minute).
The general system is configured as
passive worm defense. In future work we will
<2,4000,1,0.4,*> and τ ∈ {20,50,80,100}. From
validate the model with simulations obtained by NS2
figure 4, we make the following observations: the τ
(Network simulator); develop a common platform of
plays an important role in both the number of
simulating passive worms in order to improve the
infected peers and propagation speed. The larger τ is,
simulating efficiency.
the smaller the peak will be. This can win valuable
Acknowledgment
time to defend against passive worms. For users, the
method of improving temporary immunity period is
The work is supported by the National Natural
to update the anti virus software in time. If all users
Science Foundation of China under Grant No.
can do this, the damages caused by passive worms
60633020, the Natural Science Foundation of Hebei
will minimize.
Province of China under Grant No.F2006000177, the
Natural the Natural Science Foundation of Hebei
4
Conclusions and Future work
This paper proposes a delayed SEIRS model with
online rate, offline rate and death rate by the use of
the epidemic dynamics. The simulation results show
the propagation of passive worms being mainly
Education Department of Hebei China under Grant
No. 2004445.
IEEE Computer and Communications Societies,
References
[1] Eng KL, Crowcroft J, Marcelo P, Sharma R and
Lim S. “A survey and comparison of peer-to-peer
overlay network schemes,” Journal of. IEEE
Communications Survey and Tutorial, vol. 7,
[2] Zhou L, Zhang L, Mcsherry F, Immorlica N and
Chien S. “A first look at peer-to-peer worms:
threats and defenses,” in Proceedings of Fourth
International Workshop on Peer-to-Peer Systems
Robert
S.
G.
“Simulating
non-scanning worms on peer-to-peer networks,”
in
Proceedings
of
malware
in
peer-to-peer
networks,”
in
Proceedings of the Sixth ACM SIGCOMM on
the
[7] Xia CH, Shi YP Li XJ. “Research on epidemic
models of P2P worm in structured peer-to-peer
networks,” Chinese Journal of Computers, vol.
29, no. 6, pp. 952-959, 2006.
[8] Krishna R and Biplab S. “Modeling malware
(IPTPS'05), pp. 24-35, 2005.
C,
[6] Andrew K, Abhinav A, Minaxi G. “A study of
Internet Measurement, pp. 327-332, 2006.
no.4, pp.72-93, 2005.
[3] Guanling
pp. 1890-1900, 2003.
1st
International
Conference on Scalable Information Systems,
pp.29-42, 2006.
[4] Yu W, Cobey B, Sriram C, et al. “Peer-to-peer
system-based active worm attacks: modeling and
analysis,” in Proceedings of IEEE International
Conference on Communications, pp. 295-299,
2005.
[5] Zesheng C, Lixin G, and Kwiat.K. “Modeling the
spread of active worms,” in Proceeding of
Twenty-Second Annual Joint Conference of the
propagation in
Gnutella type peer-to-peer
networks,” in The Third International Workshop
on Hot Topics in Peer-to-Peer Systems, pp. 8-15,
2006.
[9] Hanxun Zhou, Yingyou Wen, Hong Zhao.
“Passive worm propagation modeling and
analysis,” in International Multi-Conference on
Computing
in
the
Global
Information
Technology (ICCGI'07), pp. 32-35, 2007.
[10] Thommes R. and Coates M. “Epidemiological
modeling of peer-to-peer viruses and pollution,”
in The Twenty-fifth Annual IEEE Conference on
Computer Communications (INFOCOM'06), pp.
[16] Krishna P. G, Richard J. D, and Stefan Saroiu,
et al. “Measurement, modeling, and analysis of a
15-26, 2006.
[11] Richard W.T and Mark J.C. “Modeling virus
peer-to-peer
file-sharing
workload,”
in
propagation in peer-to-peer networks,” in IEEE
Proceedings of the 19th ACM Symposium on
International
Information,
Operating System Principles, pp. 314-329, 2003.
Communications & Signal Processing (ICICS
[17] K.Cooke, P.Driessche. “Analysis of an SEIRS
Conference
on
2005), pp. 981-985, 2005.
epidemic model with two delays,” Journal of
[12] Ping Yan, Shengqiang Liu. “SEIR epidemic
model with delay,” Journal of the Australian
Mathematical Society, Series B - Applied
Mathematics, vol. 48, no.1, pp. 119-134, 2006.
[13] Bimal K.M and Dinesh K.S. “SEIRS epidemic
model with delay for transmission of malicious
objects
in
computer
network,”
pp. 1476-1482, 2007.
[14] Newman M.E.J, Strogatz S.H and Watts D.J.
graphs
with
arbitrary
degree
distribution and their applications,” Phys.Rev.E.
64:026118, 2001.
[15] Jacky C, Kevin L and Brian N.L. Availability
and popularity measurements of peer-to-peer file
systems. Technical Report 04-36, 2004.
240-260, 1996.
[18] P.Holme,
B.J.Kim.
“Growing
scale-free
networks with tunable clustering,” Physical
Review E (Statistical Nonlinear, and Soft Matter
Physics), vol. 64, no. 2, pp.1-4,2002.
Applied
Mathematics and Computation, vol. 188, no. 2,
“Random
Mathematical Biology, vol. 35, no. 2, pp.
Fangwei Wang received his B.S degree from
College of Mathematics & Information
Sciences at Hebei Normal University,
Shijiazhuang, China, and the M.Eng. degree in
College of Computer Science and Software at
Hebei University of Technology, Tianjin, China, in
2000 and 2003, respectively. Since 2006, he has
been working toward the Ph.D. degree in School of
Computer Science and Technology at the Xidian University, Xi’an,
China. He serves as a member of China Computer Federation. His
research interests include network and information security, sensor
networks.
Yunkai Zhang received his B.Eng. degree,
M.Eng. degree, Ph.D from Hebei University,
Beijing
University
of
Posts
and
Telecommunications, Xidian University, China
respectively. He is currently an professor with
the College of Mathematics & Information
Sciences, Hebei Normal University. He serves as
a member of China Computer Federation. His
research interests include network and information security.
Jianfeng Ma is
vice-dean of School
University, doctoral
cryptography and
a professor and the
of Computer in Xidian
candidate's advisor of
computer application
technology, Subject leaders of
Computer Science and
Technologies, director of Key Lab. of Computer Networks and
Information Security. He received his B.S degree from the
Department of Mathematics at Shannxi Normal University,
Xi’an, China, in 1985. He specialized in Communication and
Electronic System, receiving the M.Eng. degree in 1989 and the
Ph.D. degree in 1995, all form Xidian University, Xi’an, China.
He is a senior member of the Chinese institute of electronics,
IEEE member. His current research interests include: theory and
technology with system security; existence of information and
system; theory and technology of the network security.