Internet Worms Research Articles

통계적 방법을 이용한 웜 전파 모델링

인터넷 웜은 컴퓨터 네트워크를 이용하여 자기 자신을 자동으로 복제해서 전파하는 프로그램이다. 컴퓨터간의 네트워크 연결이 증가함에 따라 인터넷 웜은 급격해 확산되었고 큰 위협으로 남아있다. 코드 레드, 님다, 슬레머 같은 인터넷 웜의 특성과 이들의 활동을 억제하는 방법을 찾기 위해서 웜이 전파되는 특성을 연구하려는 많은 시도가 있었다. 네트워크 특징들이 인터넷 웜 전파에 미치는 영향은 모델의 간단성과 유사성 때문에 주로 의학계에서 사용되는 전염병 전파 모델을 이용하여 모델링이 되었다. 이런 의학계 모델링은 널리 사용되면서 여러 개선된 모델들이 다양하게 제안되었다. 우리는 이전의 제안된 모델들의 문제점을 분석한 후 통계적 방법을 사용하여 정확도를 높이는 새로운 방법의 웜 전파 모델링을 제안한다. An Internet worm is a self-replicating malware program which uses a computer network. As the network connectivity among computers increases, Internet worms have become widespread and are still big threats. There are many approaches to model the propagation of Internet worms such as Code Red, Nimda, and Slammer to get the insight of their behaviors and to devise possible defense methods to suppress worms' propagation activities. The influence of the network characteristics on the worm propagation has usually been modeled by medical epidemic model, named SI model, due to its simplicity and the similarity of propagation patterns. So far, SI model is still dominant and new variations of the SI model, called SI-style models, are being proposed for the modeling of new Internet worms. In this paper, we elaborate the problems of SI-style models and then propose a new accurate stochastic model using an occupancy problem.

Toward early warning against Internet worms based on critical‐sized networks

ABSTRACTIn this paper, we build on a recent worm propagation stochastic model, in which random effects during worm spreading were modeled by means of a stochastic differential equation. On the basis of this model, we introduce the notion of the critical size of a network, which is the least size of a network that needs to be monitored, in order to correctly project the behavior of a worm in substantially larger networks. We provide a method for the theoretical estimation of the critical size of a network in respect to a worm with specific characteristics. Our motivation is the requirement in real systems to balance the needs for accuracy (i.e., monitoring a network of a sufficient size in order to reduce false alarms) and performance (i.e., monitoring a small‐scale network to reduce complexity). In addition, we run simulation experiments in order to experimentally validate our arguments. Finally, based on notion of critical‐sized networks, we propose a logical framework for a distributed early warning system against unknown and fast‐spreading worms. In the proposed framework, propagation parameters of an early detected worm are estimated in real time by studying a critical‐sized network. In this way, security is enhanced as estimations generated by a critical‐sized network may help large‐scale networks to respond faster to new worm threats. Copyright © 2012 John Wiley & Sons, Ltd.

The Research on Control Strategy of Worms Spread in Complex Network in Industry

Internet worms have been a severe threat to the Internet infrastructure and hosts recently. However, because of its outbreak of a sudden and massive make the worm’s research facing enormous challenges. This article describes a simulation system based on NS2 worm - WSS. First, by processing BGP routing table information to the Internet used for simulation of the abstract network, then the model-based epidemiological model of worm propagation, and finally in the two in NS2 combination to achieve the simulation of worm propagation. Experiments show that, WSS can get in a lab environment similar to actual worm outbreak statistics, in understanding the macroscopic behavior of the worm, the worm flow forecasting, transmission speed and damage have a wide range of applications.

A virtual necessity: Some modest steps toward greater cybersecurity

Revelations about the Stuxnet computer worm raise the possibility of damaging cyberattacks on the US electrical power grid or other critical infrastructure. Several approaches might mitigate cyberthreats to critical infrastructure and information technology targets. Among them are efforts to defend the information systems that support important infrastructure, to deter enemies from cyberattacks on those systems, to reduce or eliminate the forces that might be used in cyberattacks, or to reach arms control agreements that limit or proscribe such cyberattacks. Although each of these approaches is unlikely to be successful in and of itself, each is worthy of further exploration. Taken together, they may yield benefits that make cyberspace more secure.

Centralized Parallel form of Pattern Matching Algorithm in Packet Inspection by Efficient Utilization of Secondary Memory in Network Processor

The Network detection engine have capable of inspecting the packet and find out increasing number of network worms and virus . The high level of network providing packet inspection in detection system and the network equipments applies the predefined pattern to identify and manage the monitor packet over the network. Therefore consequently the emerging high level network equipments need to contribute pattern matching and packet inspection. However, searching for patterns at multiple offsets in entire content of network packet requires more processing power than most general purpose processor can provide. We present a novel architecture for programmable centralized parallel pattern matching algorithm for efficient packet inspection with network processor . We mapped our centralized multi parallel pattern matching algorithm [CNMPPMA] for filter packet in parallel. The simulation result reveals that CNMPPMA significantly improves the matching performance.

Control Strategy on Worms Spread in Complex Networks

Abstract First, a preliminary understanding of what is meant by complex network and its features, and network worm virus that understanding and analysis of the emergence and development of the worm, the worm to understand the current situation, focus on the worm propagation model (simple propagation model, Kermack-Mckendrick model, SIS model, two-factor model, BCM model - network worms against the model). Contact the characteristics of complex networks and the worm theory, detection and prevention of worms and an important node in the network-based control strategy (target immunity, virus containment) for a simple discussion.

Adaptive Human Behavior in a Two‐Worm Interaction Model

The complex interactions among internet worms have great impact on the dynamics of worms. To contain the propagation of worms, it is necessary to characterize these interactions. Therefore, a two‐worm interaction model is presented in this paper. Different from previous researches, we have considered the influence of adaptive human reaction stirred by one cooperative worm on the other worm in the model. The model’s equilibria and their stability conditions are obtained mathematically and verified by simulations. Results indicate that considering adaptive human behavior significantly changes the prospective propagation course of worms and that this consideration has implications for designing counterworm methods.

Defensive computer worms: an overview

Worms have always been mentioned within the context of malware; indeed, the media has always referred to these self-replicating and self-propagating network programs as malicious. But there is another side of worms, in which its distinctive features can be utilised to protect - rather than damage - enterprise networks. In this paper, we discuss this very controversial topic and shed some light on its history, philosophy, features, definitions, design guidelines, and distinguish between malicious and defensive worms in an attempt to break the common negative conception usually held towards computer worms.

Modeling and Containment of Uniform Scanning Worms

Self-propagating codes called worms such as Code Red, Nimda, and Slammer have drawn significant attention due to their enormously adverse impact on the Internet. Thus, there is great interest in the research community in modeling the spread of worms and in providing adequate defense mechanisms against them. In this model, we present a (stochastic) branching process model for characterizing the propagation of Internet worms. The model is developed for uniform scanning worms and then extended to preference scanning worms. This model leads to the development of an automatic worm containment strategy that prevents the spread of a worm beyond its early stage. Specifically, for uniform scanning worms, we are able to determine whether the worm spread will eventually stop. We then extend our results to contain uniform scanning worms. Our automatic worm containment schemes effectively contain both uniform scanning worms and it is validated through simulations . The Internet has become critically important to the financial viability of the national and the global economy. Meanwhile, we are witnessing an upsurge in the incidents of malicious code in the form of computer viruses and worms. One class of such malicious code, known as random scanning worms, spreads itself without human intervention by using a scanning strategy to find vulnerable hosts to infect

An enhanced architecture for pattern matching in FPGA for intrusion detection in wireless sensor networks

Due to increasing number of network worms and virus, network users are vulnerable to malicious attacks. A network intrusion detection system NIDS provides an effective security solution. It monitors network traffic for suspicious data patterns, and informs system administrators to take proper actions. Implementing NIDS in WSNs have unique constraints as compared to traditional networks making the implementation of existing security measures impracticable due to limitation in data memory, code space and energy to power the sensor. In this paper, a novel FPGA-based signature match co-processor structural design is proposed. The computational complexity of our proposed bitmap encoder based NIDS is compared with ROM based NIDS. Experimental results show that the proposed architecture due to the reduction in the hardware leads to an efficient reduction in the size of the sensor nodes, increases the speed of the network and decreases the power consumption of the WSN.

Word sense disambiguation for spam filtering

Spam has become a major issue in computer security because it is a channel for threats such as computer viruses, worms, and phishing. More than 86% of received e-mails are spam. Historical approaches to combating these messages, including simple techniques such as sender blacklisting or the use of e-mail signatures, are no longer completely reliable. Many current solutions feature machine-learning algorithms trained using statistical representations of the terms that most commonly appear in such e-mails. However, these methods are merely syntactic and are unable to account for the underlying semantics of terms within messages. In this paper, we explore the use of semantics in spam filtering by introducing a pre-processing step of Word Sense Disambiguation (WSD). Based upon this disambiguated representation, we apply several well-known machine-learning models and show that the proposed method can detect the internal semantics of spam messages.

Darknet-Based Inference of Internet Worm Temporal Characteristics

Internet worm attacks pose a significant threat to network security and management. In this work, we coin the term Internet worm tomography as inferring the characteristics of Internet worms from the observations of Darknet or network telescopes that monitor a routable but unused IP address space. Under the framework of Internet worm tomography, we attempt to infer Internet worm temporal behaviors, i.e., the host infection time and the worm infection sequence, and thus pinpoint patient zero or initially infected hosts. Specifically, we apply statistical estimation techniques and propose method of moments, maximum likelihood, and linear regression estimators. We show analytically and empirically that our proposed estimators can better infer worm temporal characteristics than a naive estimator that has been used in the previous work. We also demonstrate that our estimators can be applied to worms using different scanning strategies such as random scanning and localized scanning.

A Decision Support System for Placement of Intrusion Detection and Prevention Devices in Large-Scale Networks

This article describes an innovative Decision Support System (DSS) for Placement of Intrusion Detection and Prevention Systems (PIDPS) in large-scale communication networks. PIDPS is intended to support network security personnel in optimizing the placement and configuration of malware filtering and monitoring devices within Network Service Providers’ (NSP) infrastructure, and enterprise communication networks. PIDPS meshes innovative and state-of-the-art mechanisms borrowed from the domains of graph theory, epidemic modeling, and network simulation. Scalable network exploitation models enable to define the communication patterns induced by network users (thereby establishing a virtual overlay network), and parallel attack models enable a PIDPS user to define various interdependent network attacks such as: Internet worms, Trojans horses, Denial of Service (DoS) attacks, and others. PIDPS incorporates a set of deployment strategies (employing graph-theoretic centrality measures) in order to facilitate intelligent placement of filtering and monitoring devices; as well as a dedicated network simulator in order to evaluate the various deployments. Experiments with PIDPS indicate that incorporating knowledge on the overlay network (network exploitation patterns) into the placement and configuration of malware filtering and monitoring devices substantially improves the effectiveness of intrusion detection and prevention systems in NSP and enterprise networks.

Modeling and analysis of gradual hybrid anti-worm

The gradual hybrid anti-worm (GHAW) was presented. It changed its confrontation scheme in real time according to the percentage of vulnerable hosts present in the network. For GHAW, its process of countering malicious internet worms was modeled. The performance of GHAW on two factors was also estimated: confronting validity against worms and consumption of network resources. Factors governing its performance, specifically the transformation threshold and the transformation rate, were analyzed. The simulation experiments show that GHAW has dynamical adaptability to changes of network conditions and offers the same level of effectiveness on confronting internet worms as the divide-and-rule hybrid anti-worm, with significantly less cost to network resources. The experiments also indicate that the transformation threshold is the key factor affecting the performance of GHAW.

Behaviour Based Worm Detection and Signature Automation

Problem statement: A worm is a malicious piece of code that self-prop agates, often via network connections, to exploit security flaws in c omputers connected through the network. In general, worms do not need any human intervention to propagate and are considered a real threat to network assets and the properties of organizations. An Intr usion Detection Systems (IDSs) are employed to detect the presence of the worms in the network. Approach: This study proposed a new behaviour- based worm detection and signature automation approach that consists of scanning characteristics to find vulnerable hosts and indicate the correlation between an infected host and potential destination hosts. Results: This approach can be distinguish between network s canning (random and sequential TCP and UDP worm scanning) triggered by infected and non-infected hosts. In addition, the ability to detect the worms based on its behaviours. Conclusion: Identifying network worms at an early stage can increase the protection of network services and vulnerable hosts.

Preserving quality of service for normal users against DDoS attacks by using Double Check Priority Queues

Owing to the increasing threat of malwares and attacks, the defense mechanism design of various attacks becomes an important issue. Currently, there are various kinds of malwares, such as computer viruses, Trojan-horses, spywares, adwares, worms, and zombies, etc. Attacks are like zero-day attack, black-hole attack, Denial of Service attacks, man-in-the-middle attack and so on. The above attacks will be threats to the computer systems. This article focuses on the defense mechanism for Distributed Denial of Service (DDoS) attacks. DDoS attacks use a lot of request packets or garbage packets to occupy network bandwidth and consume performance of the target host. If the attack target is a commercial website, DDoS attacks will cause transmission delay and more seriously they will deny web services. In this paper, we propose a Double Check Priority Queue structure that effectively mitigates the impact of DDoS attacks in order that normal users can still access services.

Predicting the Propagation Path of Random Worm by Subnet Infection Situation Using Fuzzy Reasoning

Predicting the propagation path of a network worm is highly beneficial for taking appropriate countermeasures in advance. Traditional worm propagation models mainly deal with the total number of infected hosts during a period of time, which cannot indicate a worm's track. We choose the worm using random scanning to study, as it was the basic type and all the others were derived from it. A novel model proposed in this paper locates the subnets going to be infected at a given time based on the infection measurement of the subnet. The time and frequency for victims in the subnet to increase were calculated according to common characteristics of worm diffusion and the relationship between malicious traffic and bandwidth usage. Taking the two factors above as input, fuzzy reasoning was adopted to deduce the real-time infection situation for each subnet. The bigger the value of infection situation, the more likely the corresponding subnet would be attacked in a short time. Simulation experimental results show that the model estimates the worm's track dynamically with acceptable accuracy. Furthermore, the increase interval of victims in subnet is much longer for worm with slower spread speed, which provides sufficient time to carry out pertinent response.

A Comment on “A Necessary and Sufficient Condition for Deadlock-Free Adaptive Routing in Wormhole Networks”

The purpose of this comment is to show that Duato's condition for deadlock freedom is only sufficient and not necessary. We propose a fix to keep the condition necessary. The issue is subtle but essential: in a wormhole network worms necessarily do not intersect.

Stability analysis of VEISV propagation modeling for network worm attack

In this paper, we propose VEISV (vulnerable – exposed – infectious – secured – vulnerable) network worm attack model, which is appropriate for measuring the effects of security countermeasures on worm propagation. Contrary to existing models, our model takes into consideration accurate positions for dysfunctional hosts and their replacements in state transition. Using the reproduction rate, we derive global stability of a worm-free state and local stability of a unique worm-epidemic state. Furthermore, simulation results show the positive impact of increasing security countermeasures in the vulnerable state on worm-exposed and infectious propagation waves. Finally, equilibrium points are confirmed by phase plots.

Pulse quarantine strategy of internet worm propagation: Modeling and analysis

Worms can spread throughout the Internet very quickly and are a great security threat. Constant quarantine strategy is a defensive measure against worms, but its reliability in current imperfect intrusion detection systems is poor. A pulse quarantine strategy is thus proposed in the current study. The pulse quarantine strategy adopts a hybrid intrusion detection system with both misuse and anomaly detection. Through analysis of corresponding worm propagation models, its stability condition is obtained: when the basic reproduction number is less than one, the model is stable at its infection-free periodic equilibrium point where worms get eliminated. Numerical and simulation experiments show that constant quarantine strategy is inefficient because of its high demand on the patching rate at “birth”, whereas the pulse quarantine strategy can lead to worm elimination with a relatively low value. As patching almost all hosts in the actual network is difficult, the pulse quarantine strategy is more effective in worm elimination.