关键词: 攻击相关性, 蠕虫传播, 感染概率, 状态转移概率

Abstract: The infection probability of the network node directly affects the propagation process of the worm, and the correlation of the attack behavior increases the infection probability of the node. This paper proposes a worm propagation model-STIR that considers attack correlation. According to the characteristics of attack correlation, the model presents the update formula of the infection probability. The state transition probability method is used to mathematically describe the propagation process, and the calculation formula of the propagation threshold is deduced. Finally, the simulation experiment is performed in a scale-free network. The results verify the correctness of propagation threshold. Compared with the worm propagation model which does not consider attack correlation, this model can simulate the worm propagation process better. At the same time, it is also showed that the increase in the initial value of the infection probability, the rate of infection change and the propagation probability also accelerate the speed and scale of worm propagation.

Key words: attack correlation, worm propagation, the infection probability, state transition probability