Abstract: In this paper，the scanning strategy of Internet worm In hybrid（IPv4/IPv6） network environment which existing a large number of NAT are first analyzed.A new type of worm，TeredoWorm based on Teredo service is built.This worm applies two different layers scanning strategy.It means that the worm apply subnet scanning strategy in local subnet and apply scanning strategy based on Teredo service in inter-subnet.Based on the Layered scanning strategy，a Layered Model（LM） is presented.The results of simulation experiment show that TeredoWorm is a worm that can propagate fastly in the large-scale inIPv4/IPv6 network，at the same time this paper predicts a enormous threat posed by the new worm in hybrid network.

Key words: IPv4/IPv6, Internet worm, Network Address Transiation（NAT）, worm scanning strategy

摘要： 首先在存在大量NAT的混合型（IPv4/IPv6）网络环境中分析了网络蠕虫的扫描策略，构建了一种新型的基于 Teredo服务的网络蠕虫—TeredoWorm，该蠕虫应用分层扫描策略为在本地应用子网内扫描策略；在子网间应用基于Teredo服务的扫描策略。并在此基础上建立了一种分层蠕虫传播模型（Layered Model，LM）。经仿真实验结果表明，TeredoWorm是一种可以在IPv4/IPv6网络中穿越NAT进行大范围传播的蠕虫，其将对IPv4/IPv6网络的安全性带来巨大的威胁。

关键词: IPv4/IPv6, 网络蠕虫, 网络地址转换（NAT）, 蠕虫扫描策略