Abstract
Instant Messaging group is the new feature added into the IM system. In the IM group network, two IM users are considered connecting if they are in the same group, which is the essential difference from previous topology. We study worms under IM group topology for the first time. After analyzing the real data, we propose some new propagation approaches of worms and prove their efficiency. To prevent IM group worms, we propose some new defense methods and define some new items. Results can be greatly helpful to administrators of the IM service.
Introduction
The topology of IM has been proved as a scale-free [1], but the group feature of IM is not considered in the previous work. Motivated by this, we do the research on the worms under IM group topology for the first time.
The Statistics
We use QQ, the largest IM software in China, to do the research. We write a network spider to get the information of groups and members. The statistics feature of IM group: No. of links per user is 106.89, clustering coefficient is 0.54, and average diameter is 4.58.
Experiments
We simulate worms on the real topology. The results show that reinfection and non-reinfection have the same propagation speed. A group sensitive infection case introduces nearly zero traffic, and the initial speed is as fast as others.
To defend IM group worms, we make the definitions of “vaccination” and “immunization.” Vaccination means disabling the accounts of the most connected points on the network to increase the network's diameter. Immunization means some well-educated users do not click worm messages, therefore they are immune from worms and viruses.
Vaccination can be done by administrators, while immunization only can be achieved by users. Satisfactory Rate can reflect the quality of the IM service.