Benign Worms Research Articles

Modeling of malicious code propagation in the industrial control network

With the development of digitalization, industrial control network have more connections and open to external network, which breaks their “isolation” from Internet and makes them more vulnerable to be attacked especially by malicious code. To model and analyze the impact of different containment strategies for attacks by malicious code in the industrial control network, the SUIQMR model is established to simulate malicious code propagation. Since the industrial control network is often coupled with Internet, industrial control coupling network is also considered in the SUIQMR model and the containment strategies of quarantine,benign worms and honeypot are added into the model to evaluate their effect against malicious code propagation.The simulation results show the effectiveness of our model.

Impulsive Switching Epidemic Model with Benign Worm Defense and Quarantine Strategy

The issue on how to effectively control Internet malicious worms has been drawn significant attention owing to enormous threats to the Internet. Due to the rapid spreading of malicious worms, it is necessary to explore the integrated measures to automatically mitigate the propagation on the Internet. In this paper, a novel worm propagation model is established, which combines both impulsive quarantine and benign worm implementation. Then, sufficient conditions for the global stability of worm-free periodic solution and the permanence of the benign worm are obtained. Finally, the effects of quarantine strategy are assessed and some feasible strategies that can constrain the propagation of malicious worm are provided by numerical simulation.

Bifurcation analysis of an e-SEIARS model with multiple delays for point-to-group worm propagation

In this paper, by taking two important network environment factors (namely point-to-group worm propagation and benign worms) into consideration, a mathematical model with multiple delays to model the worm prevalence is presented. Sufficient conditions for the local stability of the unique endemic equilibrium and the existence of a Hopf bifurcation are demonstrated by choosing the different combinations of the three delays and analyzing the associated characteristic equation. Directly afterward, the stability and direction of the bifurcated periodic solutions are investigated by using center manifold theorem and the normal form theory. Finally, special attention is paid to some numerical simulations in order to verify the obtained theoretical results.

Analysis of Two-Worm Interaction Model in Heterogeneous M2M Network

With the rapid development of M2M (Machine-to-Machine) networks, the damages caused by malicious worms are getting more and more serious. By considering the influences of the network heterogeneity on worm spreading, we are the first to study the complex interaction dynamics between benign worms and malicious worms in heterogeneous M2M network. We analyze and compare three worm propagation models based on different immunization schemes. By investigating the local stability of the worm-free equilibrium, we obtain the basic reproduction number R0 . Besides, by using suitable Lyapunov functions, we prove that the worm-free equilibrium is globally asymptotically stable if R0 ≤ 1 , otherwise unstable. The dynamics of worm models is completely determined by R0 . In the absence of birth, death and users’ treatment, we obtain the final size formula of worms. This study shows that the nodes with higher node degree are more susceptible to be infected than those with lower node degree. In addition, the effects of various immunization schemes are studied. Numerical simulations verify our theoretical results. The research results are meaningful for us to further understand the spread of worms in heterogeneous M2M network, and enact effectual control tactics.

Influences of Removable Devices on the Anti-Threat Model: Dynamic Analysis and Control Strategies

With the rapid development of M2M wireless network, damages caused by malicious worms are getting more and more serious. The main goal of this paper is to explore the influences of removable devices on the interaction dynamics between malicious worms and benign worms by using a mathematical model. The model takes two important network environment factors into consideration: benign worms and the influences of removable devices. Besides, the model’s basic reproduction number is obtained, along with the correct control conditions of the local and global asymptotical stability of the worm-free equilibrium. Simulation results show that the effectiveness of our proposed model in terms of reflecting the influences of removable devices on the interaction dynamics of an anti-treat model. Based on numerical analyses and simulations, effective methods are proposed to contain the propagation of malicious worms by using anti-worms.

Stability analysis of an e-SEIAR model with point-to-group worm propagation

Internet worms have drawn significant attention due to their enormous threats to the Internet. The main goal of this paper is to explore the interaction dynamics between a malicious worm and an benign worm, using a mathematical model, namely e-SEIAR. The e-SEIAR model takes two important network environment factors into consideration: point-to-group worm propagation mode and benign worms. Furthermore, some related dynamics properties are studied, along with the analysis of how to combat the worm prevalence based on the stability of equilibria. Simulation results show that the performance of our proposed models is effective in combating such worms, in terms of decreasing the number of hosts infected by the malicious worm and reducing the malicious worm propagation speed. Based on our simulations, we believe there is great potential for an effective method to use benign worms to combat malicious worms in some point-to-group applications.

Mediating Cross-Domain Network Threat in Cooperative Way

Network attacks, either in aggressive or silent way, are main threat to network security. Modern network environment normally involves multiple domains, and there are connections between them, so an adversary can impact the important network domain via attacking a normal one. When the threat is found in one domain, there isnt a mean to identify how large scale this threat has spread, and there isnt an effective method to mediate such threat. This paper focused on detecting the real topology of multi-domain network and proposed a cooperative method to mediate the threat propagation. The network topology is identified by tracing the propagation of designed benign worm, and the cooperative method is based on novelly collaborating local firewalls on hosts. Performance evaluation is given at the end of this paper to demonstrate the feasibility and effectiveness of the proposed measure.

Spread and Control of Mobile Benign Worm Based on Two-Stage Repairing Mechanism

Both in traditional social network and in mobile network environment, the worm is a serious threat, and this threat is growing all the time. Mobile smartphones generally promote the development of mobile network. The traditional antivirus technologies have become powerless when facing mobile networks. The development of benign worms, especially active benign worms and passive benign worms, has become a new network security measure. In this paper, we focused on the spread of worm in mobile environment and proposed the benign worm control and repair mechanism. The control process of mobile benign worms is divided into two stages: the first stage is rapid repair control, which uses active benign worm to deal with malicious worm in the mobile network; when the network is relatively stable, it enters the second stage of postrepair and uses passive mode to optimize the environment for the purpose of controlling the mobile network. Considering whether the existence of benign worm, we simplified the model and analyzed the four situations. Finally, we use simulation to verify the model. This control mechanism for benign worm propagation is of guiding significance to control the network security.

Network Application Technology with High-Fidelity Modeling of Worm Containment with Benign Worms

Worm infection is a critical problem for network application technology and security. In order to decrease the destruction of worm to network application technology, a worm containment method using benign worms was proposed, and an approach of high-fidelity modeling on packet-level of worm propagation and containment with benign worms was designed. The experiment results show that benign worms can contain the infection of malicious worms effectively, and the initial locality of worm, the delay time between the start time of benign worm and malicious worm, background traffic of the network will affect the propagation and containment of worms.

Strategy of fast and light-load cloud-based proactive benign worm countermeasure technology to contain worm propagation

Benign worms have been attracting wide attention in the field of worm research due to the proactive defense against the worm propagation and patch for the susceptible hosts. In this paper, two revised Worm–Anti-Worm (WAW) models are proposed for cloud-based benign worm countermeasure. These Re-WAW models are based on the law of worm propagation and the two-factor model. One is the cloud-based benign Re-WAW model to achieve effective worm containment. Another is the two-stage Re-WAW propagation model, which uses proactive and passive switching defending strategy based on the ratio of benign worms to malicious worms. This model intends to avoid the network congestion and other potential risks caused by the proactive scan of benign worms. Simulation results show that the cloud-based Re-WAW model significantly improves the worm propagation containment effect. The cloud computing technology enables rapid delivery of massive initial benign worms, and the two stage Re-WAW model gradually clears off the benign worms with the containment of the malicious worms.

A Revised Benign Worm-Anti-Worm Propagation Model

Due to the proactive defend against the worm propagation and patch the susceptible hosts, benign worms are attracting wide attentions in the worm research. In this paper, we put forward a revised benign worm-anti-worm propagation model to achieve effective containment of worms.

Fast quarantining of proactive worms in unstructured P2P networks

P2P worms pose a serious threat to Internet infrastructure and terminal users because of their overwhelming propagation speed. Manual reactions fall behind the fast propagation of P2P worms. Current automatic techniques are still not adequate to be deployed on a large scale for several challenges including low accuracy, low efficiency, etc. In this paper, we bring forward a repair-and-patch approach to quarantine malicious worms quickly in unstructured P2P networks. Our work has two major contributions. Firstly, we propose two kinds of benign worms, which differ in functions and spread strategies, to cooperatively battle against malicious worms. Secondly, we derive discrete difference equations to depict the interplay between malicious and benign worms. Four factors — manual countermeasures, P2P topology, configuration diversity and attack and defense strategies — are modeled in the equations. Preliminary experiments are promising. Compared with sheer manual reactions, our approach is about two times faster and protects about 35% more hosts. In comparison with benign worms, which search targets by random scanning, our proposed method guards about 34.4% more hosts with lower consumption of bandwidth resources.

Passive Benign Worm Propagation Modeling with Dynamic Quarantine Defense

Worm attacks can greatly distort network performance, and countering infections can exact a heavy toll on economic and technical resources. Worm modeling helps us to better understand the spread and propagation of worms through a network, and combining effective types of mitigation techniques helps prevent and mitigate the effects of worm attacks. In this paper, we propose a mathematical model which combines both dynamic quarantine and passive benign worms. This Passive Worm Dynamic Quarantine (PWDQ) model departs from previous models in that infected hosts will be recovered either by passive benign worms or quarantine measure. Computer simulation shows that the performance of our proposed model is significantly better than existing models, in terms of decreasing the number of infectious hosts and reducing the worm propagation speed.