Analysis and Modeling of the Botnet Propagation Characteristics

The process of worm propagation can be deeply analyzed based on epidemic model according to the different network environment. However, the propagation process of botnet is different from worm, and the infected hosts finish the cooperation according to the different tasks. The hosts used for botnet propagation are only a part of infected hosts, and the botnet propagation is controlled by its master. Based on SIR model, this paper models the characteristics of botnet propagation, and analyzes the relationship between the number of infected hosts and propagation ratio. Meanwhile, by introducing the definition of the stable propagation duration, the network stability can be analyzed quantitatively. The model theoretically analyzes the relationship among the propagation ratio, the botnet scale and the stability, and points out that the characteristics of controlled botnets can better adapt to the development trend of the increasing decentralization of the botnet scale.