Internet Worms Research Articles

GRBC-based Network Security Functions placement scheme in SDS for 5G security

With the paradigm shift of 5G in terms of computing and infrastructure, 5G security is confronted with new challenges due to the promising introduction of Software Defined Networks (SDN), Network Function Virtualization (NFV) and Cloud Computing. While most of current works on 5G security are focused on high-level analysis of challenges and threats to satisfy the emerging use cases. Software Defined Security (SDS), as a new security paradigm which provides flexible and centralized security protection for varieties of networks especially for SDN and Cloud environment, can be a potential security solution in 5G. Lots of work have focused on the implementations and details of SDS, and most researchers, however, are focusing on the controller design and security policy design. There are few work on the placement strategy of Network Security Functions (NSFs) and devices, which plays a significant role in SDS to improve the optimize defence effects. Most of existing placement schemes are modelled as Integer Linear Programming (ILP) by considering the constrains in terms of resource, time, security and so on, and introduce various heuristic algorithm to reduce its computing complexity. While in this paper, we propose a placement scheme of NSFs and devices in SDS based on underlying routing characteristic and evaluate its performance defending virus attack. The proposed scheme adopts Group Routing Betweenenss Centrality (GRBC) as a metric and introduces a successive algorithm to compute the GRBC. Different to traditional Routing Betweenness Centrality which only considers the importance of single node, the proposed scheme can find the key group of nodes in a SDS underlying network, where the NSFs and security devices should be deployed. In the performance evaluation, we apply our scheme to the scenario of computer virus and worms control in SDS, and the results show that the proposed scheme can improve the performance of security functions in SDS system.

A review of the use of optimal control in social models

Optimal control is a powerful optimization technique derived from the mathematical theory of the Calculus of Variations. It can be employed to maximize the returns from and minimize the costs associated with physical, social, and economic processes. In recent years, optimal control theory has been utilized to develop ideal intervention strategies for a variety of “contagious” social ailments that are spread chiefly by contact with affected peers—like crime, substance abuse and the rampant infiltration of internet worms and viruses in computerized systems. As the dynamics of these processes are akin to that of an epidemic, the compartmental models utilized for studying the spread of infectious diseases can be easily adapted for these types of problems. In this article, we review the use of optimal control theory in the design of cost effective intervention strategies for the successful mitigation of social contagion processes.

Pre-Vaccination and Quarantine Approach for Defense Against Worms Propagation of Malicious Objects in Wireless Sensor Networks

Network security poses a challenge to wireless sensor networks (WSNs) achieving its true potential. It is hard to tackle due to operational constraints of networks. Worms have become an emergent threat to the wireless networks. The spread of worms in the network is epidemic in nature. This article proposes a novel mathematical model with pre-vaccination and quarantine for study of worm propagation dynamics in WSN that is based on epidemic model. Further, the authors have devised an expression to determine threshold communication radius and node density. The objective of this proposed model is to study the propagation dynamics of worms in wireless sensor networks. Through the model, investigate the stability condition of networks in the presence of malicious codes. The experimental studies indicate that the proposed model outperforms in terms of security and energy efficiency over other existing models. It is a leap toward worm-controlling mechanisms in sensor networks. Finally, the control mechanism and performance of the proposed model is validated through extensive simulation results.

State feedback impulsive control of computer worm and virus with saturated incidence.

A state feedback impulsive model is set up to discuss the spreading and control of the computer worm and virus. Considering the transmission features, saturated infectious is adopted to describe the spreading in the model, and all the treatment measures, such as patching operating system and updating antivirus software, are assumed to take effect instantly. Then the model is analyzed with a novel method, and the existence and stability of order-1 limit cycle are discussed. Finally, the numerical simulation is listed to verify the result of the paper.

An Epidemic Model of Computer Worms with Time Delay and Variable Infection Rate

With rapid development of Internet, network security issues become increasingly serious. Temporary patches have been put on the infectious hosts, which may lose efficacy on occasions. This leads to a time delay when vaccinated hosts change to susceptible hosts. On the other hand, the worm infection is usually a nonlinear process. Considering the actual situation, a variable infection rate is introduced to describe the spread process of worms. According to above aspects, we propose a time-delayed worm propagation model with variable infection rate. Then the existence condition and the stability of the positive equilibrium are derived. Due to the existence of time delay, the worm propagation system may be unstable and out of control. Moreover, the threshold τ0 of Hopf bifurcation is obtained. The worm propagation system is stable if time delay is less than τ0. When time delay is over τ0, the system will be unstable. In addition, numerical experiments have been performed, which can match the conclusions we deduce. The numerical experiments also show that there exists a threshold in the parameter a, which implies that we should choose appropriate infection rate β(t) to constrain worm prevalence. Finally, simulation experiments are carried out to prove the validity of our conclusions.

The Spatial–Temporal Perspective: The Study of the Propagation of Modern Social Worms

Due to the critical security threats imposed by social worms, such as Twitter and Facebook, modeling and simulation study of the propagation dynamics of social worms is essential to predict their potential for damage and to understand the propagation characteristics. Modern social worms exhibit one new feature, reinfection-notification . It indicates that malicious messages are sent by neighbors whenever any susceptible or infected recipients open the malicious attachments, and a user will get reminders when new messages come to a social account. Meanwhile, there are two critical problems: dynamic host usage and temporal message processing . First, from a spatial perspective, previous models have not taken into account that public hosts in different locations are shared by several users arising from human mobility, namely, dynamic host usage . Second, from a temporal perspective, the problem of temporal message processing results from the improper assumption that during this period of message checking, unread messages all are read by default, or under the condition that some parts of messages have been read, but the rest of unread messages are no longer processed afterward. To address these problems, we present a novel social worm simulation model in this paper, which adopts “social network-based sharing” and “sorting and attenuation” methods. We perform comprehensive theoretical analyses and experimental evaluation to validate our simulation model. The results show that our model is more suitable for modeling the complicated propagation behaviors of modern social worms in hierarchical networks.

SADI: A Novel Model to Study the Propagation of Social Worms in Hierarchical Networks

As more and more people rely on social networks for business and life, social worms constitute one of the major security threats to our society. Modern social worms exhibit two new features, message notification and the temporal characteristic of human mobility . Message notification indicates a user will get a reminder once a new message comes to a social account. The temporal characteristic of human mobility indicates a user can operate corresponding computer in different locations with different resting time. Previous scholars have proposed some analytical models for the propagation dynamics of social worms. However, they did not consider the above two features and there is one critical problem unrealized, which is structural imperfection of network topology . Previous models have not taken into account the hierarchical topology structure, which results from a many-to-many relationship between users and hosts. To address these problems, we model propagation dynamics of social worms oriented hierarchical networks in this paper, and the proposed model accurately describes the propagation behavior of social worms. We conduct both a theoretical analyses and extensive simulations to show our model can overcome inaccuracy in the number of infected nodes and provide a stronger approximation for the worm propagation. The results show that our model presented in this paper achieves a greater accuracy in characterizing the propagation of modern social worms.

Design and evaluation of a system for network threat signatures generation

The paper addresses a problem of cybersecurity that plays the strategic role in modern computer networks. The attention is focused on the usage of pre-generated signatures to detect malicious content in network traffic. Given the rapid propagation of computer threats, it is crucial to detect them in early stage of an infection. Therefore, the main challenge is to design and develop efficient mechanisms for generation of their signatures. Nowadays, manually generated signatures of computer worms are commonly used for identifying malicious activity in the networks. Creation of such signatures often requires hours or even days of work, while the time limit for signatures generation for active worms is measured in minutes, at the most. Thus, attack trends change very fast, making it impossible to keep up with manual signature engineering and an automatic generation of signatures seems to be the only reasonable solution. In this paper, we investigate a problem of automatic generation of signatures of zero-day polymorphic worms. We developed an efficient algorithm for token extraction and a novel method for automatic multi-token signature composition. Our method employs a genetic algorithm to produce signatures accurately matching network worms. We designed and developed a framework for offline generation of signatures implementing our method. The efficiency and utility of the system was verified through simulation. The test cases were carried out on data combining real flows and synthetic flows imitating real malicious Internet traffic. The results of experiments performed for selected polymorphic worms demonstrate that our framework may be successfully used to create the high quality signatures in a reasonable time.

SVEIRS epidemic model with delays and partial immunization for internet worms

A delayed SVEIRS model for the transmission of worms in internet with partial immunization is proposed. The impact of the possible combination of the two delays on the model is investigated. By analyzing the corresponding characteristic equations and regarding the possible combination of the two delays as the bifurcation parameter, local stability of the endemic equilibrium and existence of local Hopf bifurcation at the viral equilibrium are addressed, respectively. Further, explicit formulas that determine direction and stability of the Hopf bifurcation are derived with the help of the normal form theory and the center manifold theorem. Finally, some numerical simulations are carried out to verify the obtained theoretical findings.

Security analysis of an advanced metering infrastructure

An advanced metering infrastructure is an integrated system of smart meters, communications networks and data management systems designed to support the safe, efficient and reliable distribution of electricity while providing advanced functionality to energy customers. Unfortunately, sophisticated cyber attacks on advanced metering infrastructures are a clear and present danger. The most devastating scenario involves a computer worm that traverses advanced metering infrastructures and permanently disables millions of smart meters.This paper presents a security analysis of an advanced metering infrastructure comprising more than one million smart meters, 100+ data collectors and two meter data management systems. Specifically, it provides detailed evaluations of the attack surface, targets – especially the critical data collectors – and their functionality, and possible attacks and their impacts. The systematic identification of each target and its functionality, and possible attacks and their direct impacts, are essential to understanding the security landscape as well as specifying and prioritizing mitigation efforts as part of a robust risk management program. Although this work is based on an analysis of one large advanced metering infrastructure, strong attempts have been undertaken to extract and articulate the commonalities when describing the attack surface, targets, possible attacks and their impacts. Thus, the results presented in this paper can be used as a foundation upon which the unique aspects of an advanced metering infrastructure can be added to create a robust risk management program geared for the specific deployment.

MICROTUBULE BASED NEURO-FUZZY NESTED FRAMEWORK FOR SECURITY OF CYBER PHYSICAL SYSTEM

Network and system security of cyber physical system is of vital significance in the present information correspondence environment. Hackers and network intruders can make numerous fruitful endeavors to bring crashing of the networks and web services by unapproved interruption. Computing systems connected to the Internet are stood up to with a plenty of security threats, running from exemplary computer worms to impart drive by downloads and bot networks. In the most recent years these threats have achieved another nature of automation and sophistication, rendering most defenses inadequate. Ordinary security measures that depend on the manual investigation of security incidents and attack advancement intrinsically neglect to give an assurance from these threats. As an outcome, computer systems regularly stay unprotected over longer time frames. This study presents a network intrusion detection based on machine learning as a perfect match for this issue, as learning strategies give the capacity to naturally dissect data and backing early detection of threats. The results from the study have created practical results so far and there is eminent wariness in the community about learning based defenses. Machine learning based Intrusion Detection and Network Security Systems are one of these solutions. It dissects and predicts the practices of clients, and after that these practices will be viewed as an attack or a typical conduct.

Study of the stability of a SEIRS model for computer worm propagation

Nowadays, malware is the most important threat to information security. In this sense, several mathematical models to simulate malware spreading have appeared. They are compartmental models where the population of devices is classified into different compartments: susceptible, exposed, infectious, recovered, etc. The main goal of this work is to propose an improved SEIRS (Susceptible–Exposed–Infectious–Recovered–Susceptible) mathematical model to simulate computer worm propagation. It is a continuous model whose dynamic is ruled by means of a system of ordinary differential equations. It considers more realistic parameters related to the propagation; in fact, a modified incidence rate has been used. Moreover, the equilibrium points are computed and their local and global stability analyses are studied. From the explicit expression of the basic reproductive number, efficient control measures are also obtained.

High-probability and wild-card scenarios for future crimes and terror attacks using the Internet of Things

PurposeThe purpose of this paper is to provide a framework to thinking and creating scenarios about future crimes and terror attacks relying on the Internet of Things (IoT), and to present a crowdsourcing research based on this thinking, which resulted in both high- and low-probability scenarios with dramatic impact.Design/methodology/approachThe research relies on general morphological analysis for deconstructing wicked problems into core components, and on crowdsourcing 50 experts on Wikistrat’s commercial platform, allowing them to suggest core components, rank them by importance and develop scenarios together. This methodology allowed a wider view than usual, and allowed the experts to examine unorthodox combination of components, leading to the creation of wild-card scenarios.FindingsAnalysis of both the core components and the resulting scenarios indicates that the IoT is set to have a dramatic role in crime and terror attacks in the near future. High-impact high-probability scenarios include attacks on power plants, cyber wallets and personal assistants. High-impact low-probability scenarios include terrorist attacks by environmentalist groups, accidental attacks conducted by immature pranksters and having a computer worm propagating in a low-security but critical facility like a hospital.Originality/valueThis paper brings a standardized method which can be used to examine complex events like crime and terror attacks using a disruptive and emerging technology. The results can be used by practitioners to further study the issue and develop many other scenarios more tailored to their needs. The scenarios presented in this paper can also be of value to security bodies who wish to be better prepared for the future.

ANALISA PENDETEKSIAN WORM dan TROJAN PADA JARINGAN INTERNET UNIVERSITAS SEMARANG MENGGUNAKAN METODE KALSIFIKASI PADA DATA MINING C45 dan BAYESIAN NETWORK

<p>Worm attacks become a dangerous threat and cause damage in the Internet network. If the Internet network worms and trojan attacks the very disruption of traffic data as well as create bandwidth capacity has increased and wasted making the Internet connection is slow. Detecting worms and trojan on the Internet network, especially new variants of worms and trojans and worms and trojans hidden is still a challenging problem. Worm and trojan attacks generally occur in computer networks or the Internet which has a low level of security and vulnerable to infection. The detection and analysis of the worm and trojan attacks in the Internet network can be done by looking at the anomalies in Internet traffic and internet protocol addresses are accessed.<br />This research used experimental research applying C4.5 and Bayesian Network methods to accurately classify anomalies in network traffic internet. Analysis of classification is applied to an internet address, internet protocol and internet bandwidth that allegedly attacked and trojan worm attacks.<br />The results of this research is a result of analysis and classification of internet addresses, internet protocol and internet bandwidth to get the attack worms and trojans.</p>

An epidemiological model of internet worms with hierarchical dispersal and spatial clustering of hosts

Beginning in 2001, many instances of malicious software known as Internet worms have been using biological strategies such as hierarchical dispersal to seek out and spread to new susceptible hosts more efficiently. We measured the distribution of potentially susceptible hosts in the space of Internet addresses to determine their clustering. We have used the results to construct a full-size simulated Internet with 232 hosts with mean and variance of susceptible hosts chosen to match our measurements at multiple spatial scales. Epidemiological simulations of outbreaks among the roughly 2.8×106 susceptible hosts on this full-sized network show that local preference scanning greatly increases the chances for an infected host to locate and infect other susceptible hosts by a factor of as much as several hundred. However, once deploying this strategy, the overall success of a worm is relatively insensitive to the details of its dispersal strategy over a wide range of parameters. In addition, although using localized interactions may allow malicious software to spread more rapidly or to more hosts on average, it can also lead to increased variability in infection levels among replicate simulations. Using such dispersal strategies may therefore be a high risk, high reward strategy for the authors of such software.

Delay Induced Hopf Bifurcation of an Epidemic Model with Graded Infection Rates for Internet Worms

A delayed SEIQRS worm propagation model with different infection rates for the exposed computers and the infectious computers is investigated in this paper. The results are given in terms of the local stability and Hopf bifurcation. Sufficient conditions for the local stability and the existence of Hopf bifurcation are obtained by using eigenvalue method and choosing the delay as the bifurcation parameter. In particular, the direction and the stability of the Hopf bifurcation are investigated by means of the normal form theory and center manifold theorem. Finally, a numerical example is also presented to support the obtained theoretical results.

SAIDR: A New Dynamic Model for SMS-Based Worm Propagation in Mobile Networks

Recently, short message service (SMS) has become one of the most popular applications for mobile users. However, it provides convenience for worms to spread in mobile networks. Due to the differences between computers and smartphones, the current propagation models of computer worms cannot be employed in the mobile network directly, especially in the SMS scenario. In this paper, we propose a worm propagation model based on SMS, named susceptible-affected-infectious-suspended-recovered. To accurately predict the worm propagation via SMS, first, we add the affected state to represent the state of users who have received the messages but have not clicked the malicious links. Second, since an infected node does not always send malicious messages to others, a novel state, the suspended state, is introduced to describe this situation. Furthermore, related stabilities of the worm-free equilibrium and the endemic equilibrium are studied. The worm-free equilibrium is locally and globally asymptotically stable if the basic reproduction number ${R}_{0} , whereas the endemic equilibrium is locally asymptotically stable if $R_{0}>1$ . Finally, comprehensive experiments have been done to support our conclusions and confirm the rationality.

Computer Worms Based on Monitoring Replication and Damage: Experiment and Evaluation

Computer Worms Based on Monitoring Replication and Damage: Experiment and Evaluation

Epidemics of Multiple Internet Worm Variants and Its Countermee

Epidemics of Multiple Internet Worm Variants and Its Countermee

Analysis of SVEIR worm attack model with saturated incidence and partial immunization

Internet worms can propagate across networks at terrifying speeds, reduce network security to a remarkable extent, and cause heavy economic losses. Thus, the rapid elimination of Internet worms using partial immunization becomes a significant matter for sustaining Internet infrastructure. This paper addresses this issue by presenting a novel worm susceptible-vaccinated-exposed-infectious-recovered model, named the SVEIR model. The SVEIR model extends the classical susceptible-exposed-infectious-recovered model (refer to SEIR model) through incorporating a saturated incidence rate and a partial immunization rate. The basic reproduction number in the SVEIR model is obtained. By virtue of the basic reproduction number, we prove the global stabilities of an infection-free equilibrium point and a unique endemic equilibrium point. Numerical methods are used to verify the proposed SVEIR model. Simulation results show that partial immunization is highly effective for eliminating worms, and the SVEIR model is viable for controlling and forecasting Internet worms.