A novel worm propagation model based on SDN dynamic honeypots

Addressing the issue of existing worm propagation models lacking proactive defense mechanisms against novel worm viruses within network attack environments, this paper establishes a propagation model based on dynamic honeypots, considering the proactive defense capabilities of honeypots and the network control flexibility offered by software-defined networking (SDN). To accurately predict worm behaviour, considering that actual worm attacks are not one-step, a new state named threatened state is introduced into the classical susceptible-infectious-recovered (SIR) model. Subsequently, to analyse the influence of SDN dynamic honeypots on worm propagation, a game state corresponding to the threatened state in real networks is incorporated, and the STIR-HB model is proposed. The equilibrium point and basic reproduction number of the model are calculated, and the stability of the equilibrium point is proved. This model provides a theoretical foundation for future applications in scenarios such as enterprise networks, cloud computing environments, and critical infrastructure systems.