Internet Worms Research Articles

Research on Simulation and Modeling of Social Network Worm Propagation

Along with the rapid development of social networks,social network worms have constituted one of the major internet security problems.In the paper,the social network worm propagation is discussed from the viewpoint of social engineering,and a human behavior model based on game theory is presented for predicting the expected actions of network user encountered with worm messages.By analyzing network users' diurnal activity behaviors,a discrete social network accessing model is proposed to characterize the general human habit of accessing certain social network.Then a simulation system is constructed with the two models and validated by simulations on the effect of human factors on propagations.Finally,the results of simulation experiments on artificial social networks show the impacts of network topology and number of hybrid nodes on social network worm propagation and indicate that this simulation system can provide great support for social network worm related researches.

Eliminating Errors in Worm Propagation Models

Research on worm propagation has been conducted for over a decade. However, traditional models overestimate the scale of the infected network that leads to propagation errors because of limited and inaccurate analysis of the propagation procedure between each pair of nodes in the network. This paper studies the propagation mechanism of the two main classes of worms: scanning worms (Code Red II) and nonreinfection email worms. We aim at eliminating overestimation in worm propagation modeling caused by errors. Through the analysis of the propagation procedure, we observe that the error is mainly caused by propagation cycles in the propagation path, which are usually ignored by traditional models. Our simulations and analysis show the fact that the existence of errors has non-negligible effect on worm propagation modeling. We quantify the error and propose a method to eliminate it.

Churn-Resilient Protocol for Massive Data Dissemination in P2P Networks

Massive data dissemination is often disrupted by frequent join and departure or failure of client nodes in a peer-to-peer (P2P) network. We propose a new churn-resilient protocol (CRP) to assure alternating path and data proximity to accelerate the data dissemination process under network churn. The CRP enables the construction of proximity-aware P2P content delivery systems. We present new data dissemination algorithms using this proximity-aware overlay design. We simulated P2P networks up to 20,000 nodes to validate the claimed advantages. Specifically, we make four technical contributions: 1). The CRP scheme promotes proximity awareness, dynamic load balancing, and resilience to node failures and network anomalies. 2). The proximity-aware overlay network has a 28-50 percent speed gain in massive data dissemination, compared with the use of scope-flooding or epidemic tree schemes in unstructured P2P networks. 3). The CRP-enabled network requires only 1/3 of the control messages used in a large CAM-Chord network. 4) Even with 40 percent of node failures, the CRP network guarantees atomic broadcast of all data items. These results clearly demonstrate the scalability and robustness of CRP networks under churn conditions. The scheme appeals especially to web-scale applications in digital content delivery, network worm containment, and consumer relationship management over hundreds of datacenters in cloud computing services.

Enhanced Topic-based Vector Space Model for semantics-aware spam filtering

Spam has become a major issue in computer security because it is a channel for threats such as computer viruses, worms and phishing. More than 85% of received e-mails are spam. Historical approaches to combat these messages including simple techniques such as sender blacklisting or the use of e-mail signatures, are no longer completely reliable. Currently, many solutions feature machine-learning algorithms trained using statistical representations of the terms that usually appear in the e-mails. Still, these methods are merely syntactic and are unable to account for the underlying semantics of terms within the messages. In this paper, we explore the use of semantics in spam filtering by representing e-mails with a recently introduced Information Retrieval model: the enhanced Topic-based Vector Space Model (eTVSM). This model is capable of representing linguistic phenomena using a semantic ontology. Based upon this representation, we apply several well-known machine-learning models and show that the proposed method can detect the internal semantics of spam messages.

Hopf bifurcation in an Internet worm propagation model with time delay in quarantine

Internet worm attacks reduce network security and cause economic losses. The use of a quarantine strategy is prominent in defending against worms, and it has been applied to various worm propagation models. Although theoretical analysis suggests that worms must get eliminated under quarantine, such a result does not appear in a real network. The time delay considered in this paper, which is caused by the time window of the intrusion detection system (IDS) that exists in the propagation system, is one of the main reasons for this. A worm propagation model with time delay under quarantine is constructed for practical application. The stability of the positive equilibrium and local Hopf bifurcation are discussed. By analysis, a critical value τ0 of the Hopf bifurcation is derived. When the time delay is less than τ0, the worm propagation system is stable and easy to predict; when it is equal to or greater than τ0, Hopf bifurcation appears. Since it is easy to control and eliminate worms under a simple and stable worm propagation system without Hopf bifurcation, the time window of the IDS must be adjusted so that the time delay is less than τ0, which ensures that the worm propagation system remains stable and that worms can be eliminated with certain containment strategy. Numerical results from our experiment support our theoretical analysis.

Internet Worm Modeling and Analysis in IPv6 Networks

With the development of IPv6, it is taken as a natural cover to defend against Internet worm due to its huge address space. We demonstrate that an intelligent worm can compromise the IPv6 network according to using adaptive means. Based on the analysis of the scanning strategies in IPv6 network and correlative typical propagation technologies, a general worm model named Next Generation Internet worm model (NGIWM) is established for analyzing the propagation of IPv6 worm which is made up of three layers. The three layers have the function to accelerate the spread of NGIWM, and make NGIWM has the capability to form large scale of prevalence. The result indicates the rationality of scanning strategies and the effectiveness of the propagation compared to IPv4 network worm. The simulation shows that the implementation of NGIWM has the potential to become a major threat to IPv6 network. The performance of the worm depends heavily on domain name generator algorithm and scanning strategies in local network. We also analyze the effect of experiment parameters on the model in the simulation part. In the future, detailed implementation of the proposed model and more defense mechanisms are to be studied.

Comparing Measles With Previous Eradication Programs: Enabling and Constraining Factors

Five major disease eradication initiatives were initiated during the second half of the 20th century. The enabling and constraining factors-political, social, economic, and other-for these previous and current eradication programs can inform decision making regarding a proposed measles eradication initiative. We reviewed the literature on the yaws, malaria, smallpox, guinea worm, and polio eradication programs and compared enabling and constraining factors for each of these programs with the same factors as they relate to a possible measles eradication initiative. A potential measles eradication program would enjoy distinct advantages in comparison with earlier eradication programs, including strong political and societal support, economic analyses demonstrating a high level of cost-effectiveness, and a rigorous upfront process, compared with previous eradication initiatives, that has validated the feasibility of achieving measles eradication. However, increasing population density, urbanization, and wars/civil conflicts will pose serious challenges. Measles eradication will be very challenging but probably not as difficult to achieve as polio eradication. Measles eradication should be undertaken only if the commitments and resources will be adequate to meet the political, social, economic, and technical challenges.

An Automated Signature Generation Approach for Polymorphic Worms Using Principal Component Analysis

Internet Worms pose a major threat to Internet infrastructure security. Security experts manually generate the IDS signatures by studying the network traces after a new worm has been released, a rather costly, laborious, and time consuming task. In this paper we propose automated signature generation system for polymorphic worms. We apply Principal Component Analysis (PCA) to determine the most significant substrings that are shared between polymorphic worm instances and use them as signatures. The experimental results show that the PCA has successfully detected polymorphic worms with zero false positives and low false negatives.

Fast quarantining of proactive worms in unstructured P2P networks

P2P worms pose a serious threat to Internet infrastructure and terminal users because of their overwhelming propagation speed. Manual reactions fall behind the fast propagation of P2P worms. Current automatic techniques are still not adequate to be deployed on a large scale for several challenges including low accuracy, low efficiency, etc. In this paper, we bring forward a repair-and-patch approach to quarantine malicious worms quickly in unstructured P2P networks. Our work has two major contributions. Firstly, we propose two kinds of benign worms, which differ in functions and spread strategies, to cooperatively battle against malicious worms. Secondly, we derive discrete difference equations to depict the interplay between malicious and benign worms. Four factors — manual countermeasures, P2P topology, configuration diversity and attack and defense strategies — are modeled in the equations. Preliminary experiments are promising. Compared with sheer manual reactions, our approach is about two times faster and protects about 35% more hosts. In comparison with benign worms, which search targets by random scanning, our proposed method guards about 34.4% more hosts with lower consumption of bandwidth resources.

Performance evaluation of the Cognitive Packet Network in the presence of network worms

Reliable networks that provide good service quality are expected to become more crucial in every aspect of communication, especially as the information transferred between network users gets more complex and demanding and as malicious users try to deliberately degrade or altogether deny legitimate network service. The Cognitive Packet Network (CPN) routing protocol provides Quality of Service (QoS) driven routing and performs self-improvement in a distributed manner, by learning from the experience of special packets, which gather on-line QoS measurements and discover new routes. Although CPN is generally very resilient to network changes, it may suffer worse performance during node failures caused by network threats, such as network worms. Here we evaluate the performance of CPN in such crises and compare it with the Open Shortest Path First (OSPF) routing protocol, an industry standard and widely used in Internet Protocol networks. We also improve it by introducing a failure detection element that reduces packet loss and delay during failures. Our experiments were performed in a real networking testbed.

Influence of removable devices on computer worms: Dynamic analysis and control strategies

Worms spreading via both Web-based scanning and removable devices account for a major part of threats on internet. However, their dynamical behavior and controlling methods remain unclear. As a result, we present a computer worm model incorporating specific features unique to those worms, in this paper. The threshold value R 0 determining whether the worms die out is obtained. Theoretical analysis shows that if R 0 < 1 the disease-free equilibrium is globally asymptotically stable; otherwise, the disease will be prevalent. Additionally, some control strategies are given. Our results are illustrated by numerical simulations.

Clash over Iran's capability

Effects of sanctions and computer worm on uranium production are disputed.

Model analysis of multiple-worm propagation

The complex interactions among Internet worms have great impact on the dynamics of worms.To contain the propagation of worm,it is necessary to characterize these interactions.However,previous models have been single worm's models.Therefore,a two-worm interaction model was presented in this paper,which focused on the influence of cooperative worm.Furthermore,the model's equilibria and their stability conditions were obtained mathematically and then verified by simulation.The analytical and simulated results show that the cooperative worm can facilitate the spread of other worms and it is also shown that the cooperative worm can be terminated based on its stability condition and timely patching technology.

The Effect of P2P-Based Worm Propagation in an IPv6 Internet

It is commonly believed that the IPv6 provides greater security against worms by its huge address space. We show that a P2P-based worm can exploit the P2P services to spread in the IPv6 Internet. The P2P-based worm applies a two-phase scanning mechanism to find targets. The behavior of such a worm in this paper is modeled. We explore via analysis and simulation the spread of such worms in an IPv6 Internet. Our results indicate that such a worm can exhibit propagation speeds comparable to an IPv4 random-scanning worm. We develop a detailed analytical model that reveals the relationship between network parameters and the spreading rate of the worm in an IPv6 world. It is also noted that the P2P-based worm may influence the propagation of the worm in the Internet.

Welcome to the Geo‐Information Age

Welcome to the geo‐information age. Along with cyberprobes and computer worms like Stuxnet, which at least temporarily disabled Iran's centrifuges without a missile being fired or a bomb dropped, Wikileaks is redefining national security as we've known it.

A Novel Malware Clustering Method Using Frequency of Function Call Traces in Parallel Threads

With the rapid development and proliferation of the Internet, cyber attacks are increasingly and continually emerging and evolving nowadays. Malware - a generic term for computer viruses, worms, trojan horses, spywares, adwares, and bots - is a particularly lethal security threat. To cope with this security threat appropriately, we need to identify the malwares' tendency/characteristic and analyze the malwares' behaviors including their classification. In the previous works of classification technologies, the malwares have been classified by using data from dynamic analysis or code analysis. However, the works have not been succeeded to obtain efficient classification with high accuracy. In this paper, we propose a new classification method to cluster malware more effectively and more accurately. We firstly perform dynamic analysis to automatically obtain the execution traces of malwares. Then, we classify malwares into some clusters using their characteristics of the behavior that are derived from Windows API calls in parallel threads. We evaluated our classification method using 2,312 malware samples with different hash values. The samples classified into 1,221 groups by the result of three types of antivirus softwares were classified into 93 clusters. 90% of the samples used in the experiment were classified into 20 clusters at most. Moreover, it ensured that 39 malware samples had characteristics different from other samples, suggesting that these may be new types of malware. The kinds of Windows API calls confirmed the samples classified into the same cluster had the same characteristics. We made clear that antivirus softwares named different name to malwares that have same behavior.

Ronald Deibert: Tracking the emerging arms race in cyberspace

The director of the University of Toronto’s Citizen Lab—an interdisciplinary R&D group that works on issues related to digital media, global security, and human rights—describes the new militarization of cyberspace. Deibert’s recent work reveals evidence of sophisticated cyber-espionage aimed at corporations, governments, and human rights groups. In this interview, he explains the implications of these developments on international relations, describes how surging cybersecurity budgets are creating a kind of cyber military-industrial complex, and explains how a computer worm called Stuxnet is an example of a cyber threat to the nuclear complex and other industrial systems. He argues that today’s deteriorating cyber-environment poses immediate threats to the maintenance of online freedom and longer-term threats to the integrity of global communications networks.

Proactive Detection of Computer Worms Using Model Checking

Although recent estimates are speaking of 200,000 different viruses, worms, and Trojan horses, the majority of them are variants of previously existing malware. As these variants mostly differ in their binary representation rather than their functionality, they can be recognized by analyzing the program behavior, even though they are not covered by the signature databases of current antivirus tools. Proactive malware detectors mitigate this risk by detection procedures that use a single signature to detect whole classes of functionally related malware without signature updates. It is evident that the quality of proactive detection procedures depends on their ability to analyze the semantics of the binary. In this paper, we propose the use of model checking-a well-established software verification technique-for proactive malware detection. We describe a tool that extracts an annotated control flow graph from the binary and automatically verifies it against a formal malware specification. To this end, we introduce the new specification language CTPL, which balances the high expressive power needed for malware signatures with efficient model checking algorithms. Our experiments demonstrate that our technique indeed is able to recognize variants of existing malware with a low risk of false positives.

Forensic investigation of peer-to-peer networks

Peer-to-peer (P2P) networks allow the searching and downloading of files. As files can be easily and efficiently copied using P2P software by the general public, criminal activity such as music and film piracy that rely on the transfer of large amounts of data are becoming more common. P2P networks are also used for the dissemination and storage of indecent images and malware including computer viruses, worms and spyware, and may be used by criminal gangs and terrorist groups. We examine the forensic investigation of P2P, an activity that currently lacks commonly used guidelines. Peer-to-peer (P2P) networks allow the searching and downloading of files, with their nodes acting as either producers or consumers of data and resources.^1^,^2^,^3 These environments provide a logical 'mesh' overlaying the physical network. Currently there are numerous P2P programs in general use on the Internet - examples of commonly used P2P systems include Gnutella, eDonkey, Fast Track and Bit Torrent.^4^,^5^,^6

Evaluations for immunity-based anomaly detection with dynamic updating of profiles

This article presents evaluations of an immunity-based anomaly detection method with dynamic updating of profiles. Our experiments showed that the updating of both self and nonself profiles markedly decreased both the false alarm and missed alarm rates in masquerader detection. In computer worm detection, all the random-scanning worms and simulated metaserver worms examined were detected. The detection accuracy of the simulated passive worm was markedly improved.