Network Worm Propagation Research Articles

ON DISCRETE-TIME MODELS OF NETWORK WORM PROPAGATION GENERATED BY QUADRATIC OPERATORS

In this paper we consider the discrete-time dynamical systems generated by network worm propagation models based on the theory of quadratic stochastic operators(QSO). This approach simultaneously solves two important problems: exploring of the QSO trajectory‘s behavior, we described the set of limit points, thereby completely solved the main problem of dynamical systems (i), we showed a new application of the theory QSOs in worm propagation modelling (ii). We demonstrated that proposed discrete-time biologically-inspired model represents also realistic picture of the worm propagation process and such analytical models can be used in decision of some problems of computer networks.

An epidemic model with multiple delays for the propagation of worms in wireless sensor networks

A delayed SEIRS worm propagation model with the inclusion of a finite communication radius and node density for wireless sensor networks is investigated in this paper. By using different combinations of the three delays as bifurcating parameter and analyzing distribution of roots of the corresponding characteristic equation, sufficient conditions are derived for local stability of the endemic equilibrium and the existence of a Hopf bifurcation at the endemic equilibrium are addressed. By constructing a suitable Lyapunov function, sufficient conditions for global stability of the endemic equilibrium are determined. Finally, numerical simulations for a set of parameter values are performed to illustrate the analytical findings.

Novel non‐linear dynamics P2P network worm propagation and immune model

This study proposes a novel non-linear dynamic worm propagation model in order to describe the dynamics model of conditional triggered worm's propagation in the network, then proposes an immune dynamics model. First, the authors build impact factor according to actual condition; second, the conditions trigger type worm propagation model is established and the corresponding immune model is constructed; third, the epidemic is deduced non-toxic balance and do not sufficient conditions for the flood of worm is proved based on the theory of worm propagation model, and then the conditions of the worm will not overflow sufficient is proved through simulation experiments; finally, according to the simulation analysis and the characteristics of worm propagation, a series of control strategies are proposed, as well as the changing trend of worms in the network with immune ability. A series of simulation results show that the proposed models are reasonable and effective, it can more accurately reflect the worm propagation process in the real peer-to-peer (P2P) network, which can also accurately predict the worm propagation trend in P2P network.

SADI: A Novel Model to Study the Propagation of Social Worms in Hierarchical Networks

As more and more people rely on social networks for business and life, social worms constitute one of the major security threats to our society. Modern social worms exhibit two new features, message notification and the temporal characteristic of human mobility . Message notification indicates a user will get a reminder once a new message comes to a social account. The temporal characteristic of human mobility indicates a user can operate corresponding computer in different locations with different resting time. Previous scholars have proposed some analytical models for the propagation dynamics of social worms. However, they did not consider the above two features and there is one critical problem unrealized, which is structural imperfection of network topology . Previous models have not taken into account the hierarchical topology structure, which results from a many-to-many relationship between users and hosts. To address these problems, we model propagation dynamics of social worms oriented hierarchical networks in this paper, and the proposed model accurately describes the propagation behavior of social worms. We conduct both a theoretical analyses and extensive simulations to show our model can overcome inaccuracy in the number of infected nodes and provide a stronger approximation for the worm propagation. The results show that our model presented in this paper achieves a greater accuracy in characterizing the propagation of modern social worms.

The cost optimal control system based on the Kermack–Mckendrick worm propagation model

Although the network worm propagation models are able to predict trends in the spread of the worm, these papers did not consider the economic losses caused by the worm propagation. This paper uses the Hamiltonian approach of the optimal control theory and proposes the cost optical control system based on the Kermack–Mckendrick worm propagation model. In the cost optical control system, we control and process the infectious hosts. In this paper, we present an optimization model that takes into account infection cost and treatment cost. The simulation on the cost optical control system is carried out, and then the results of the analysis are given. In conclusion, the cost optical control system of the Kermack–Mckendrick model can provide the optical control of the worm propagating and effectively reduce the worm propagation with minimum cost.

NEDAC: A worm countermeasure mechanism

This article presents an Internet worm countermeasure mechanism that uses DNS activities as a behavioural technique to detect worm propagation. The mechanism also uses a data-link containment solution to block traffic from an infected host. The concept has been demonstrated using a developed prototype and tested in a virtualised network environment. An empirical analysis of network worm propagation has been conducted to test the capabilities of the developed countermeasure mechanism. The results show that the developed mechanism is sensitive in containing Internet worms. Keywords : Worm Detection, Malware, cyber defense

Модели и системы имитационного моделирования распространения сетевых червей

The paper considers the existing models and systems of network worm propagation simulation. The simulation systems NWS, SSF.App.Worm, GTNetS, PDNS and DIB:S/TRAFEN are described. The paper analyzes the advantages and disadvantages of applying these systems for network worm propagation research.

Analytical models of network worm propagation

В статье рассматриваются существующие аналитические модели распространения сетевых червей. Приводится описание как детерминированных моделей (SIS, SIR, SEIR, SAIR и PSIDR), так и стохастических.

A Defense Model of Reactive Worms Based on Dynamic Time

The popularity of reactive worms, whose attacking behavior inherits characteristics from both active worms and passive worms, has brought great threat to P2P networks in recent years. Most existing defense models only focus on the effects of P2P churn on reactive worm's propagation, but neglect the impact of user behaviors on the spread of worms. This paper proposes a defense model of reactive worms based on dynamic time with full consideration of various dynamic factors that restrict the propagation of reactive worms in real networks; then compares major distinctions of several key parameters in worms' propagation between models based on mean-field theory and the presented dynamic-time-based one; and deduces the crucial periods of time within a particular 24-hour day for defending against reactive worms' attack. Eventually simulation experiment shows this defense model is feasible and effective.

Propagation of Active Worms in P2P Networks: Modeling and Analysis

Active worms, a category of self-replicating malicious programs which could spread in an automated fashion and flood particular Peer-to-Peer(P2P) networks within very short time, have drawn significant attention. However, only limited number of studies focus on propagation model of active worms with fair consideration of P2P nodes' dynamic features consisting of P2P churn, random quarantine, regular immunization, dynamic fragmentation and etc. This paper proposes three propagation models of active worms under dynamic P2P environment, conducts a mathematical analysis on the propagation of active worms under presented models and provides extensive numerical studies to the impact of relevant parameters on active worms' propagation speed under dynamic P2P environment. Models presented in this paper are simple, effective and thus applicable for defending against active worms in real P2P networks.

Modeling the Propagation of Worms in Networks: A Survey

There are the two common means for propagating worms: scanning vulnerable computers in the network and spreading through topological neighbors. Modeling the propagation of worms can help us understand how worms spread and devise effective defense strategies. However, most previous researches either focus on their proposed work or pay attention to exploring detection and defense system. Few of them gives a comprehensive analysis in modeling the propagation of worms which is helpful for developing defense mechanism against worms' spreading. This paper presents a survey and comparison of worms' propagation models according to two different spreading methods of worms. We first identify worms characteristics through their spreading behavior, and then classify various target discover techniques employed by them. Furthermore, we investigate different topologies for modeling the spreading of worms, analyze various worms' propagation models and emphasize the performance of each model. Based on the analysis of worms' spreading and the existing research, an open filed and future direction with modeling the propagation of worms is provided.

A Study of XSS Worm Propagation and Detection Mechanisms in Online Social Networks

We present analytical models and simulation results that characterize the impacts of the following factors on the propagation of cross-site scripting (XSS) worms in online social networks (OSNs): 1) user behaviors, namely, the probability of visiting a friend's profile versus a stranger's; 2) the highly clustered structure of communities; and 3) community sizes. Our analyses and simulation results show that the clustered structure of a community and users' tendency to visit their friends more often than strangers help slow down the propagation of XSS worms in OSNs. We then present a study of selective monitoring schemes that are more resource efficient than the exhaustive checking approach used by the Facebook detection system which monitors every possible read and write operation of every user in the network. The studied selective monitoring schemes take advantage of the characteristics of OSNs such as the highly clustered structure and short average distance to select only a subset of strategically placed users to monitor, thus minimizing resource usage while maximizing the monitoring coverage. We present simulation results to show the effectiveness of the studied selective monitoring schemes for XSS worm detection.

Research on Simulation and Modeling of Social Network Worm Propagation

Along with the rapid development of social networks,social network worms have constituted one of the major internet security problems.In the paper,the social network worm propagation is discussed from the viewpoint of social engineering,and a human behavior model based on game theory is presented for predicting the expected actions of network user encountered with worm messages.By analyzing network users' diurnal activity behaviors,a discrete social network accessing model is proposed to characterize the general human habit of accessing certain social network.Then a simulation system is constructed with the two models and validated by simulations on the effect of human factors on propagations.Finally,the results of simulation experiments on artificial social networks show the impacts of network topology and number of hybrid nodes on social network worm propagation and indicate that this simulation system can provide great support for social network worm related researches.

Bifurcation analysis of a model for network worm propagation with time delay

In this paper, considering that reassembly of a system and/or using anti-virus software will take a period of time, we introduce a time delay for modeling this period of time. Also, considering that at different times the propagation of a worm shows different characteristics, we build a section model for Internet worm propagation depending on a two-factor model. We first consider the stability of the positive equilibrium and the existence of a local Hopf bifurcation. In succession, using the normal form theory and center manifold argument, we derive explicit formulas determining the stability, direction and other properties of bifurcation periodic solutions. Finally, a numerical simulation is presented. The techniques of analysis of the mathematical model provide a theoretical foundation for control and forecasting for Internet worms.

Modeling and analyzing of the interaction between worms and antiworms during network worm propagation

Interaction of antiworms with a worm population of e.g. hosts of worm infected and hosts of antiworm infected must be considered as a dynamic process. This study is an attempt for the first time to understand how introduction of antiworm affects the dynamic of network worm propagation. In this paper, we create a mathematical model (SIAR model) using ordinary differential equations to describe the interaction of worms and antiworms. Although idealized, the model demonstrates how the combination of a few proposed nonlinear interaction rules between antiworms and worms is able to generate a considerable variety of different kinds of responses. Taking the Blaster and Nachi worms as an example, we give a brief analysis for designing a practical antiworm system. To the best of our knowledge, there is no model for the spread of an antiworm that employs the passive scan and the finite lifetime and we believe that this is the first attempt on understanding the interaction between worms and antiworms.