Spread Of Worms Research Articles

Hop-by-Hop Worm Propagation with Carryover Epidemic Model in Mobile Sensor Networks

In the internet, a worm is usually propagated in a random multi-hop contact manner. However, the attacker will not likely select this random multi-hop propagation approach in a mobile sensor network. This is because multi-hop worm route paths to random vulnerable targets can be often breached due to node mobility, leading to failure of fast worm spread under this strategy. Therefore, an appropriate propagation strategy is needed for mobile sensor worms. To meet this need, we discuss a hop-by-hop worm propagation model in mobile sensor networks. In a hop-by-hop worm propagation model, benign nodes are infected by worm in neighbor-to-neighbor spread manner. Since worm infection occurs in hop-by-hop contact, it is not substantially affected by a route breach incurred by node mobility. We also propose the carryover epidemic model to deal with the worm infection quota deficiency that might occur when employing an epidemic model in a mobile sensor network. We analyze worm infection capability under the carryover epidemic model. Moreover, we simulate hop-by-hop worm propagation with carryover epidemic model by using an ns-2 simulator. The simulation results demonstrate that infection quota carryovers are seldom observed where a node’s maximum speed is no less than 20 m/s.

Analysis of Two-Worm Interaction Model in Heterogeneous M2M Network

With the rapid development of M2M (Machine-to-Machine) networks, the damages caused by malicious worms are getting more and more serious. By considering the influences of the network heterogeneity on worm spreading, we are the first to study the complex interaction dynamics between benign worms and malicious worms in heterogeneous M2M network. We analyze and compare three worm propagation models based on different immunization schemes. By investigating the local stability of the worm-free equilibrium, we obtain the basic reproduction number R0 . Besides, by using suitable Lyapunov functions, we prove that the worm-free equilibrium is globally asymptotically stable if R0 ≤ 1 , otherwise unstable. The dynamics of worm models is completely determined by R0 . In the absence of birth, death and users’ treatment, we obtain the final size formula of worms. This study shows that the nodes with higher node degree are more susceptible to be infected than those with lower node degree. In addition, the effects of various immunization schemes are studied. Numerical simulations verify our theoretical results. The research results are meaningful for us to further understand the spread of worms in heterogeneous M2M network, and enact effectual control tactics.

Worm Epidemics in Vehicular Networks

Connected vehicles promise to enable a wide range of new automotive services that will improve road safety, ease traffic management, and make the overall travel experience more enjoyable. However, they also open significant new surfaces for attacks on the electronics that control most of modern vehicle operations. In particular, the emergence of vehicle-to-vehicle (V2V) communication risks to lay fertile ground for self-propagating mobile malware that targets automobile environments. In this work, we perform a first study on the dynamics of vehicular malware epidemics in a large-scale road network, and unveil how a reasonably fast worm can easily infect thousands of vehicles in minutes. We determine how such dynamics are affected by a number of parameters, including the diffusion of the vulnerability, the penetration ratio and range of the V2V communication technology, or the worm self-propagation mechanism. We also propose a simple yet very effective numerical model of the worm spreading process, and prove it to be able to mimic the results of computationally expensive network simulations. Finally, we leverage the model to characterize the dangerousness of the geographical location where the worm is first injected, as well as for efficient containment of the epidemics through the cellular network.

모바일 환경에서 개인정보 유출 방지를 위한 개선 연구

Recently, number of tablet or Smartphone users increased significantly in domestic and around the world. But violation of personal information such as leakage, misuse and abuse are constantly occurring by using mobile devices which is very useful in our society. Therefore, in this paper it will talk about the problems in the network environment of the mobile environment such as tablet and Smartphone, Mobile Malware, hacking of the public key certificate, which could be potential threat to mobile environment. This thesis will research for people to use their mobile devices more reliable and safer in mobile environment from invasion and leakage of personal information. In order to use Smartphone safely, users have to use Wi-Fi and Bluetooth carefully in the public area. This paper will research how to use App safely and characteristic of risk of worm and Malware spreading. Because of security vulnerabilities of the public key certificate, it will suggest new type of security certification. In order to prevent from the information leakage and infect from Malware in mobile environment without knowing, this thesis will analyze the improved way to manage and use the mobile device.

Detection and Prevention to Network Worm Virus Based on Segmentation Algorithm

This paper Through an analysis of the worm propagation behavior, found that there are certain constraints relationship of network size to the propagation speed of the worm . On this basis, network segmentation algorithm based on DFS is proposed to reduce the size of the network, in order to gain subnet boundaries , in order to further suppress the spread of worms provide a theoretical basis , provide reference and basis for the erection of a network worm isolation system. the method of using DFS network segmentation algorithm based on network topology was proposed to solve large-scale network analysis. It provides a strong theoretical support for fast access network backbone node. The result of experiment shows that the proposed method is effective.

Worm propagation model in mobile network

SummaryWith the popularity of mobile smart devices and functional diversification, the infection ways of mobile smartphones worm also become diverse. In mobile networks, mobile devices are suffering from the threat of worms all the time. Once the worm outbreaks, it will bring huge losses to mobile phone users and mobile network operators. Researches on mobile worm propagation model allow us to control and detect potential worm threat, according to the characteristics of worm's outbreak. In the paper, we put forward a worm propagation model based on the mobile network environment. After analyzing the model, we then give the simulation for controlling factors affecting worm propagation. This model allows us to have a certain understanding for the spread on the size and speed of the mobile worm and provide effective methods to control the spread of the mobile worm. Copyright © 2015 John Wiley & Sons, Ltd.

Hybrid epidemics--a case study on computer worm conficker.

Conficker is a computer worm that erupted on the Internet in 2008. It is unique in combining three different spreading strategies: local probing, neighbourhood probing, and global probing. We propose a mathematical model that combines three modes of spreading: local, neighbourhood, and global, to capture the worm’s spreading behaviour. The parameters of the model are inferred directly from network data obtained during the first day of the Conficker epidemic. The model is then used to explore the tradeoff between spreading modes in determining the worm’s effectiveness. Our results show that the Conficker epidemic is an example of a critically hybrid epidemic, in which the different modes of spreading in isolation do not lead to successful epidemics. Such hybrid spreading strategies may be used beneficially to provide the most effective strategies for promulgating information across a large population. When used maliciously, however, they can present a dangerous challenge to current internet security protocols.

Modeling and Analyzing the Spread of Flash Disk Worms via Multiple Subnets

The Flash Disk worms, spreading via both Web-based scanning and removable devices between multiple subnets, have become a serious threat to the Internet, especially those physically isolated subnets. We present a model which incorporates specific features of these worms in this paper. Then, we analyze the dynamic behaviors of the model when one subnet is considered. Analytical result shows that the Flash Disk worm can self-perpetuate whenRi0>1and will die out otherwise. When multiple subnets are considered, we get that once a computer is infected by the Flash Disk worms, other computers in that subnet will be infected in a short time. Thus, for any subnet, to contain the Flash Disk worms, the most effective way is to prevent the first infected individual by improving the users’ security awareness of using removed devices. Our results are illustrated by numerical simulation.

Distributed Software-Attestation Defense against Sensor Worm Propagation

Wireless sensor networks are vulnerable to sensor worm attacks in which the attacker compromises a few nodes and makes these compromised nodes initiate worm spread over the network, targeting the worm infection of the whole nodes in the network. Several defense mechanisms have been proposed to prevent worm propagation in wireless sensor networks. Although these proposed schemes use software diversity technique for worm propagation prevention under the belief that different software versions do not have common vulnerability, they have fundamental drawback in which it is difficult to realize the aforementioned belief in sensor motes. To resolve this problem, we propose on-demand software-attestation based scheme to defend against worm propagation in sensor network. The main idea of our proposed scheme is to perform software attestations against sensor nodes in on-demand manner and detect the infected nodes by worm, resulting in worm propagation block in the network. Through analysis, we show that our proposed scheme defends against worm propagation in efficient and robust manner. Through simulation, we demonstrate that our proposed scheme stops worm propagation at the reasonable overhead while preventing a majority of sensor nodes from being infected by worm.

How Clustering Affects Epidemics in Random Networks

Motivated by the analysis of social networks, we study a model of random networks that has both a given degree distribution and a tunable clustering coefficient. We consider two types of growth process on these graphs that model the spread of new ideas, technologies, viruses, or worms: the diffusion model and the symmetric threshold model. For both models, we characterize conditions under which global cascades are possible and compute their size explicitly, as a function of the degree distribution and the clustering coefficient. Our results are applied to regular or power-law graphs with exponential cutoff and shed new light on the impact of clustering.

How Clustering Affects Epidemics in Random Networks

Motivated by the analysis of social networks, we study a model of random networks that has both a given degree distribution and a tunable clustering coefficient. We consider two types of growth process on these graphs that model the spread of new ideas, technologies, viruses, or worms: the diffusion model and the symmetric threshold model. For both models, we characterize conditions under which global cascades are possible and compute their size explicitly, as a function of the degree distribution and the clustering coefficient. Our results are applied to regular or power-law graphs with exponential cutoff and shed new light on the impact of clustering.

Time-Lag Lotka-Volterra System Application in Network Worm Modeling

This paper studies the impact of network time-lag on the spread of worms and virus, uses Lotka-Volterra equation theory with time delay, and studies the influence of network characteristics such as response time, predator copy size and interaction of network worms and predators.

A stochastic epidemiological model for the propagation of active worms considering the dynamicity of network topology

Topology-aware active worms, which use topological scanning for finding their victims, are one of the most serious threats in the Internet. Peer-to-peer (P2P) networks and applications are suitable environments for the spread of topology-aware active worms. Several models for the propagation behavior of these threats exist in the literature. Discrete-time models are usually more accurate than the continuous ones due to the nature of worm propagation, which is inherently a discrete-time process. On the other hand, as the propagation of worms is a stochastic process, the stochastic models enable us to study the stochastic characteristics of worm propagation process and are definitely useful. To the best of our knowledge, no stochastic model for the topology-aware active worm propagation has been developed yet. Also, none of the existing models consider the dynamic changes of network topology during the spread of worms. It is important that the network topology be taken into account as a key parameter in the model and at the same time, complex computations should be avoided. These are two important goals of this work, which were not considered in the existing models. In this paper, we introduce a new stochastic and discrete-time model for topology-aware active worm propagation (abbreviated as STAWP). The STAWP model considers the dynamicity of network topology and the join and leave of hosts in a simple manner. We have also extended the existing topology logic matrix (TLM) simulative model in order to meet the goals of the STAWP model. Comparing the results of our experiments using this extended model (i.e., extended TLM or ETLM) with the STAWP model, shows that their behaviors are nearly the same, which can be used to validate both models. Using the STAWP model, we have investigated the impact of several parameters in topology-aware active worm propagation process, the results of which are also presented in this paper.

A game based passive worm defense model for P2P networks

Passive worm, a huge hidden trouble to P2P applications, has drawn much attention because of its undetectable, destructive, and wide-ranging features. Existing propagation models for passive worm only noticed its similarity to biological viruses in propagation, ignored the impact of social attributes of P2P nodes on the spread of worms, such as trust relationship, network topology, security awareness and potential profit. Although these models were simple and efficient, they did not match the defense process of passive worm in dynamic environment. This paper proposes a defense model of passive worm in P2P networks. The contributions made in this paper include four aspects. First, we analyze the deficiency of current defense model of passive worm based on mean-field theory in P2P networks. Second, we build a node evaluation system based on trust relationship, by which the resource providers in P2P networks are determined. Third, we develop a defense model based on game theory. Fourth, we provide extensive numerical study and simulation experiments to the impact of some relevant model parameters on the defense of passive worm in P2P networks. The model presented in this paper is applicable for defending against passive worms in P2P networks.

Modelling and simulating worm propagation in static and dynamic traffic

Vehicular ad hoc networks (VANETs) have no fixed infrastructure and instead relies on the vehicles themselves to provide network functionality. An attack scenario with potentially catastrophic consequences is the outbreak of mobile worm epidemic in these networks. This paper analyses the snapshot spreading results under an urban scenario with equilibrium traffic through modelling the mobility pattern, the communication channel, the medium access control (MAC) mechanism and the worm propagation process. The extensive Monte Carlo simulations uncovered the effects of the transmission range (from a typical minimum to a maximum), the minimum velocity and the maximum velocity (from the free flow to the congested traffic), the vehicle density (from a sparse topology to a dense spatial relation) and the MAC mechanism (from presence to absence) on epidemic spreading of such worms in VANETs. Furthermore, the authors simulate the wireless worm propagation in dynamic traffic with the same scenario as the static traffic by using a network simulation tool. The authors discuss the correlation between snapshot results and evolutive outcome, also analyse the reasons resulting in the local differences and finally uncover the interrelations between the affected rate and network parameters. The results are expected to help engineers design intelligent and automatic detection prevention strategies for VANETs.

Defending against Malicious Threats in Wireless Sensor Network: A Mathematical Model

Wireless Sensor Networks offer a powerful combination of distributed sensing, computing and communication. They lend themselves to countless applications and at the same time constrained by limited battery life, processing capability, memory and bandwidth which makes it soft target of malicious objects such as virus and worms. We study the potential threat for worm spread in wireless sensor network using epidemic theory. We propose a new model Susceptible- Exposed-Infectious-Quarantine-Recovered with Vaccination (SEIQRS-V), to characterize the dynamics of the worm spread in WSN. Threshold, equilibrium and their stability are discussed. Numerical methods are employed to solve the system of equations and MATLAB is used to simulate the system. The Quarantine is a method of isolating the most infected nodes from the network till they get recovered and the Vaccination is the mechanism to immunize the network temporarily to reduce the spread worms.

A Defense Model of Reactive Worms Based on Dynamic Time

The popularity of reactive worms, whose attacking behavior inherits characteristics from both active worms and passive worms, has brought great threat to P2P networks in recent years. Most existing defense models only focus on the effects of P2P churn on reactive worm's propagation, but neglect the impact of user behaviors on the spread of worms. This paper proposes a defense model of reactive worms based on dynamic time with full consideration of various dynamic factors that restrict the propagation of reactive worms in real networks; then compares major distinctions of several key parameters in worms' propagation between models based on mean-field theory and the presented dynamic-time-based one; and deduces the crucial periods of time within a particular 24-hour day for defending against reactive worms' attack. Eventually simulation experiment shows this defense model is feasible and effective.

Spread and Control of Mobile Benign Worm Based on Two-Stage Repairing Mechanism

Both in traditional social network and in mobile network environment, the worm is a serious threat, and this threat is growing all the time. Mobile smartphones generally promote the development of mobile network. The traditional antivirus technologies have become powerless when facing mobile networks. The development of benign worms, especially active benign worms and passive benign worms, has become a new network security measure. In this paper, we focused on the spread of worm in mobile environment and proposed the benign worm control and repair mechanism. The control process of mobile benign worms is divided into two stages: the first stage is rapid repair control, which uses active benign worm to deal with malicious worm in the mobile network; when the network is relatively stable, it enters the second stage of postrepair and uses passive mode to optimize the environment for the purpose of controlling the mobile network. Considering whether the existence of benign worm, we simplified the model and analyzed the four situations. Finally, we use simulation to verify the model. This control mechanism for benign worm propagation is of guiding significance to control the network security.

Modeling the Propagation of Worms in Networks: A Survey

There are the two common means for propagating worms: scanning vulnerable computers in the network and spreading through topological neighbors. Modeling the propagation of worms can help us understand how worms spread and devise effective defense strategies. However, most previous researches either focus on their proposed work or pay attention to exploring detection and defense system. Few of them gives a comprehensive analysis in modeling the propagation of worms which is helpful for developing defense mechanism against worms' spreading. This paper presents a survey and comparison of worms' propagation models according to two different spreading methods of worms. We first identify worms characteristics through their spreading behavior, and then classify various target discover techniques employed by them. Furthermore, we investigate different topologies for modeling the spreading of worms, analyze various worms' propagation models and emphasize the performance of each model. Based on the analysis of worms' spreading and the existing research, an open filed and future direction with modeling the propagation of worms is provided.

스마트폰 환경에서 무선 모바일 웜 확산 방식 연구

Now we are facing various threats as side effects against the growth of smartphone markets. Malicious codes such as mobile worms may bring about disclosures of personal information and confusions to upset a national wireless backbone. In this paper, we examine the existed spreading models and try to describe the correct spread of mobile worms on smartphones. We also analyze the spreading effects, and simulate bluetooth, MMS and Wi-Fi worms by various experiments.