The gradual hybrid anti-worm （GHAW） was presented. percentage of vulnerable hosts present in the network. For GHAW It changed its confrontation scheme in real time according to the its process of countering malicious internet worms was modeled. The performance of GHAW on two factors was also estimated： confronting validity against worms and consumption of network resources. Factors governing its performance, specifically the transformation threshold and the transformation rate, were analyzed. The simulation experiments show that GHAW has dynamical adaptability to changes of network conditions and offers the same level of effectiveness on confronting internet worms as the divide-and-rule hybrid anti-worm, with significantly less cost to network resources. The experiments also indicate that the transformation threshold is the key factor affecting the performance of GHAW.
In response to the deficiencies of BitTorrent, the concept of density radius was proposed, and the distance from the maximum point of radius density to cluster center as a cluster radius was taken to solve the too large cluster radius resulted from the discrete points and to reduce the false positive rate of early recognition algorithms. Simulation results show that in the actual network environment, the improved algorithm, compared with K-means, will reduce the false positive rate of early identification algorithm from 6.3% to 0.9% and has a higher operational efficiency.
