基于双层扫描策略的IPv6蠕虫研究*

由于IPv6网络地址空间巨大,传统的基于随机扫描、顺序扫描等网络层扫描策略的IPv4蠕虫难以在IPv6网络中传播。构建了一种新型IPv6网络蠕虫——V6-Worm,该蠕虫运用双层扫描策略,在子网内和子网间分别采用基于组播和基于域间路由协议路由前缀的扫描策略,并在此基础上建立了一种双层蠕虫传播模型(double layer model,DLM)来仿真V6-Worm的传播趋势。仿真结果表明,V6-Worm可在大规模IPv6网络中传播,与采用随机扫描策略的CodeRed相比,V6-Worm具有更快的传播速度。

Resarch of IPv6 worm based on double layer scan strategy

Because of the huge address space in IPv6 network,traditional worm based on random scan,sequential scan in IPv4 network can hardly spread in IPv6 network.This paper developed a new type of IPv6 worm—V6-Worm.The worm appliesd double layer scan strategy,it applied subnet scaning starategy based on multicast in local sunbet and applied scaning strategy based on the information of BGP routing prefix in inter-subnet.Based on the double layer scanning strategy,established a double layer model(DLM)for simluating the propagation of V6-Worm.The reults of simulation show that V6-Worm can propagate in IPv6 network,and compare to random-scaning worm codered,V6-Worm can propagate more rapidly.