Internet Worms Research Articles

Dynamics of a controlled discontinuous computer worm system

Dynamics of a controlled discontinuous computer worm system

FUZZY RECURRENT MAPPINGS IN MULTIAGENT SIMULATION OF POPULATION DYNAMICS SYSTEMS

The article deals with the problems of analyzing multi-agent models of population dynamics. The problems studied are caused by a number of uncertainties associated with variables, boundary conditions, initial states, parameter values, etc. Given problems could be found in tasks associated with cyber security of critical infrastructures (e.g. DDoS attacks, computer worms, etc.). To solve this problem, a linguistic fuzzy model has been developed, which allows describing systems of population dynamics in a more realistic way. Population dynamics is described by a set of rules, each of which involves entry and exit in the form of fuzzy sets or fuzzy functions, which are applied iteratively. The complexity of describing the processes of population dynamics systems, the presence of fuzzification and defuzzification algorithms, and the use of fuzzy sets and linguistic variables make it necessary to develop new methods for analyzing such systems. The approaches proposed in the article to the study of systems of population dynamics make it possible to apply a unified description of processes of different nature in the form of a production set of rules.

Ethical Hacking Implementation for Lime Worm Ransomware Detection

Nowadays, computer worms become one of the most dangerous types of malwares threats. Computer worms have evolved during the time with sophisticated forms such as crypto type ransomware. Lime worm is one of these worm kinds. The researchers apply this worm on real environment in lab (ethically and for education purposes) and this paper presents the capabilities of this worm. This paper also presents static analysis by applying many tools, which are used to obtain the key information of lime worm. This paper discovers that applying static analysis on this type of worms is very effective and accurate. The obtained key information are used to develop a software for detecting lime worm and the ability to erase it.

Novel non‐linear dynamics P2P network worm propagation and immune model

This study proposes a novel non-linear dynamic worm propagation model in order to describe the dynamics model of conditional triggered worm's propagation in the network, then proposes an immune dynamics model. First, the authors build impact factor according to actual condition; second, the conditions trigger type worm propagation model is established and the corresponding immune model is constructed; third, the epidemic is deduced non-toxic balance and do not sufficient conditions for the flood of worm is proved based on the theory of worm propagation model, and then the conditions of the worm will not overflow sufficient is proved through simulation experiments; finally, according to the simulation analysis and the characteristics of worm propagation, a series of control strategies are proposed, as well as the changing trend of worms in the network with immune ability. A series of simulation results show that the proposed models are reasonable and effective, it can more accurately reflect the worm propagation process in the real peer-to-peer (P2P) network, which can also accurately predict the worm propagation trend in P2P network.

Impulsive Switching Epidemic Model with Benign Worm Defense and Quarantine Strategy

The issue on how to effectively control Internet malicious worms has been drawn significant attention owing to enormous threats to the Internet. Due to the rapid spreading of malicious worms, it is necessary to explore the integrated measures to automatically mitigate the propagation on the Internet. In this paper, a novel worm propagation model is established, which combines both impulsive quarantine and benign worm implementation. Then, sufficient conditions for the global stability of worm-free periodic solution and the permanence of the benign worm are obtained. Finally, the effects of quarantine strategy are assessed and some feasible strategies that can constrain the propagation of malicious worm are provided by numerical simulation.

Analysis of a basic SEIRA model with Atangana-Baleanu derivative

Since computer worms have very acute and negative effects on computer systems, they are considered as one of the malicious bodies that induce serious issues in these structures. This is why numerous efforts have been given for finding different ways to avert the unwanted occurrences which stem from computer worms' harmful behavior to this day. Our motivation is to make use of AtanganaBaleanu fractional derivative with Mittag-Leffler kernel which has latterly been brought into operation, and thus closely examine the basic SEIRA (susceptible-exposed-infectious-removed-antidotal) model associated with computer worms. To that end, we first prove the conditions that show the existence and uniqueness properties of the solutions for the fractional order model benefiting from fixed point theory. By using various values belonging to the fractional order, we also acquired different numerical simulations emphasizing that the aforementioned derivative is quite impactful.

Computer Viruses, Attacks, and Security Methods

with the fast growth of the Internet, computer threats and viruses have become a very serious issue for us, which attract public attention. Therefore, the distribution of computer viruses and worms were discussed in this study. This paper focuses on the effects of computer viruses. The main area of this paperis a brief discussion on computer viruses and security or detection methods. This study is very useful and helpful for computer users to use the different methods, possible steps to protect their system and information from any kind of possible attacks on their system.

Constructing optimal reconfigurable pattern matching tools for information security

Signature-based security tools such as network intrusion detection systems, anti-virus scanners, filters against network worms and other similar systems perform in real time computation-intensive task of multi-pattern string matching against tens of thousands or even millions of predefined malicious patterns. Due to rising traffic rates, increasing number and sophistication of attacks and the collapse of Moore's law for sequential processing, traditional software solutions can no longer meet the high requirements of today’s security challenges. Therefore, designers pay more attention to hardware approaches to accelerate pattern matching. The reconfigurable devices based on Field Programmable Gate Arrays (FPGA) combining the flexibility of software and the near-ASIC performance, have become increasingly popular for this purpose. The state-of-the-art solutions made in this area around the world were analyzed. There are three main approaches to fulfill the pattern matching using FPGA. The techniques (and underlying technologies) of these approaches are: content addressable memory (based on digital comparators), Bloom filter (based on hash-functions) and Aho-Corasick algorithm (based on finite automata). But none of them shows clear advantages over others. In this article, we propose a set of methods to increase the effectiveness of reconfigurable security tools by synthesizing optimal recognition modules that maximize the benefits of each approach. The Parallel Combination Method divides a set of patterns between several matching blocks that use different approaches to better fit each of them. The Sequential Cascading Method processes patterns in parts: if the first fragment does not match, the rest can be ignored. The Vertical Join Method couples together different approaches or techniques in a single unit to provide higher efficiency of the resulting device. The optimization procedure maximizes efficiency gains for each method. The methods and methodologies presented in this study will allow developers to create more efficient reconfigurable tools for information security systems.

Payload Based Internet Worm Disclosure using Neural Network

With the capacity of contaminating a huge number of hosts, worms speak to a noteworthy danger to the Internet. The identification against Internet worms is generally an open issue. Web worms represent a genuine danger to PC security. Conventional methodologies utilizing marks to identify worms posture little risk to the zero day assaults. The focal point of this exploration is moving from utilizing mark examples to distinguishing the vindictive conduct showed by the Internet worms. This paper displays an original thought of separating stream level highlights that can distinguish worms from clean projects utilizing information mining method, for example, neural system classifier. Our approach demonstrated 97.90% recognition rate on Internet worms whose information was not utilized as a part of the model building process

Automatic extraction and integration of behavioural indicators of malware for protection of cyber–physical networks

Abstract Conventional isolated cyber–physical systems (CPS) based industrial networks are increasingly being integrated with modern corporate information technology (IT) network. Therefore, cyber-attacks on CPS are increasing enormously and this could result in a massive damage to the machines themselves or the humans who interact with them. Malware has been one of the major source of attacks and threats to the CPS networks and computer systems. The high growth and the variety of malware variants such as Internet worms, Trojan horses and computer viruses requires periodic update of the database. Traditional malware system fulfil this requirement by manual effort from the experts though signature generation. However manual update could result into potential drawback for integrity and availability of services provided by CPS systems and protection in real-time. Machine learning technique is a natural choice to address the malware challenge for CPSs, since it can easily model and discover the underlying patterns from large-scale data sets. This paper introduces intelligent models and algorithms that can extract behavioural features and inherent attack patterns from the existing malware data, then integrates the behavioural indicators into the detection system. The main contribution of the paper is that the proposed models do not require periodic manual effort to update the database of the detection engine. We have introduced semi-supervised models using unsupervised learning including independent component analysis (ICA), global K-means clustering and multivariate exponentially weighted moving average (MEWMA) for extracting behavioural indicators which clusters the malware. Then the extracted geometric information of the clusters and hoteling T 2 of the behavioural indicators from MEWMA are incorporated into the database of existing detection system which are used with support vector machine (SVM) based supervised system. This enables the detection system to update the dynamic behavioural patterns of new malware automatically. The performances of developed semi-supervised models have been verified using malware data for both static and dynamic characteristics of malware. The summary of our experimental results demonstrate that the combination of unsupervised and supervised learning can successfully extracts behavioural indicators automatically from new malware. Performance comparison from experimental results summarize that the semi-supervised models can detect more accurately than the existing supervised models where accuracies are increased up to 100% for SVM and random forest based semi-supervised models.

Countermeasures against Worm Spreading

Vehicular ad hoc networks (VANETs) are essential components of the intelligent transport systems. They are attracting an increasing amount of interest in research and industrial sectors. Vehicular nodes are capable of transporting, sensing, processing information, and wireless communication, which makes them more vulnerable to worm infections than conventional hosts. This survey provides an overview on worm spreading over VANETs. We first briefly introduce the computer worms. Then the V2X communication and applications are discussed from malware and worms propagation perspective to show the indispensability of studying the characteristics of worm propagating on VANETs. The recent literature on worm spreading and containment on VANETs are categorized based on their research methods. The improvements and limitations of the existing studies are discussed. Next, the main factors influencing worm spreading in vehicular networks are discussed followed by a summary of countermeasure strategies designed to deal with these worms.

Optimizing Computer Worm Detection Using Ensembles

The scope of this research is computer worm detection. Computer worm has been defined as a process that can cause a possibly evolved copy of it to execute on a remote computer. It does not require human intervention to propagate neither does it attach itself to an existing computer file. It spreads very rapidly. Modern computer worm authors obfuscate the code to make it difficult to detect the computer worm. This research proposes to use machine learning methodology for the detection of computer worms. More specifically, ensembles are used. The research deviates from existing detection approaches by using dark space network traffic attributed to an actual worm attack to train and validate the machine learning algorithms. It is also obtained that the various ensembles perform comparatively well. Each of them is therefore a candidate for the final model. The algorithms also perform just as well as similar studies reported in the literature.

Research on Network Security of Campus Network

Nowadays, network security incidents often occur, such as network worms, denial of service attacks, network fraud and so on. Nowadays, the methods of network security incidents are constantly innovating, resulting in data leakage, destruction and other incidents. Campus network is the basis of daily teaching, scientific research and normal operation of schools. It is of great significance to strengthen the construction of campus network security. Based on this, this paper studies the campus network security.

Toward Network Worm Victims Identification Based on Cascading Motif Discovery

Network worms spread widely over the global network within a short time, which are increasingly becoming one of the most potential threats to network security. However, the performance of traditional packet-oriented signature-based methods is questionable in the face of unknown worms, while anomaly-based approaches often exhibit high false positive rates. It is a common scenario that the life cycle of network worms consists of the same four stages, in which the target discovery phase and the transferring phase have specific interactive patterns. To this end, we propose Network Flow Connectivity Graph (NFCG) for identifying network worm victims. We model the flow-level interactions as graph and then identify sets of frequently occurring motifs related to network worms through Cascading Motif Discovery algorithm. In particular, a cascading motif is jointly extracted from graph target discovery phase and transferring phase. If a cascading motif exists in a connected behavior graph of one host, the host would be identified as a suspicious worm victim; the excess amount of suspicious network worm victims is used to reveal the outbreak of network worms. The simulated experiments show that our proposed method is effective and efficient in network worm victims’ identification and helpful for improving network security.

A Novel Simulation System Oriented Description Language of Worm Propagation

Software simulation is one of the most common methods to study worm propagation. However, simulation process and software interface, which lack unified description, cause inefficiencies of worm propagation simulation. In order to achieve a unified description for worm propagation simulation process, we propose a Worm Propagation Simulation Description Language (WPSDL), which characterizes the software interfaces and parameters of each module in simulation process in a unified way. Meanwhile, we develop a simulation system of worm propagation oriented our presented language. In this system, we use related commands of the description language as interactive instructions, and then implement worm propagation simulation for different types of network worms. In addition, we conduct a series of experiments to analyse the impacts of worm propagation mechanism and network topology structure. The experiments show that increasing infection ability and scanning rate can improve the propagation scale significantly, and the propagation delay can influence the outbreak time and explosion intensity of worm propagation. The experiments not only provide support for the study of worm propagation mechanisms, but also verify the practicability of the description language and the simulation system.

A propagation model with defensive measures for PLC-PC worms in industrial networks

• A novel mathematical model for worms spreading in a two-layered PLC-PC coupled network is proposed. • The disease-free and endemic equilibriums of the model are acquired. • The numerical and simulation experiments of the model are performed. • The effectiveness of different defensive measures on the security of PLC-PC coupled networks is discussed. • The effectiveness of extending the connection surface on the security of PLC-PC coupled networks is discussed. Programmable logic controllers (PLCs) are important components of industrial control systems (ICSs), which are digital electronic devices with microprocessors and lack network security considerations. With the explosion of cyber-attacks on the ICS network, the concept of the worm known as PLC-PC worm that can spread between the Internet and ICS network has attracted a great deal of attention. In this paper, for the first time, we propose a propagation model to explore the spread behavior of PLC-PC worms across the PLC-PC coupled network. Theoretical analysis of the model shows the disease-free and endemic equilibriums of the network with defensive measures. And the stability of the model is examined by an epidemic threshold value. Several numerical and simulation experiments are presented to illustrate the analysis. Based on the results, some ideas for restraining the spread of PLC-PC worms or reducing the security threats of the ICS network are suggested.

Analysis of Advanced Volatile Threats Using Memory Forensics

Malwares has always been one of the greatest threat actors for the organizations with their digital information infrastructure. Malware is any malicious program, file or executable whose prime purpose is to gain an unauthorized access or cause harm to the computer or the network system. It has always been a subject of concern for computer experts or even the users as the harm due to different types of malwares is increasing exponentially. Malware can be in any form i.e.; virus, computer worm, Trojan, phishing frauds etc. These threats actors are constantly evolving with a new and sophisticated ways to avoid detection and successfully perform the attacks. The rising power and ambitions were specially seen during year 2017 and the current year that is 2018. It was observed that during year 2017, almost 230000 malware samples were produced daily and around 4000 ransomware attacks threatened the organizations. Year 2017 also saw a sharp increase in the amount of fileless malware attacks, which grew by approximately 50% in 2017. Fileless malwares poses a threat to organizations and a big challenge for the information security professionals, mainly due to its use of different non-executable file formats for infection. Therefore, it becomes very difficult to detect such threats. These threats also pose challenge for detection due to its ability to execute its malicious logic exclusively in memory. This paper analyses in detail the file less malwares along with the similar volatile threats. As a solution, a tool has been proposed which can be useful in detecting such threat factors.

Detection algorithm for internet worms scanning that used user datagram protocol

The main purpose of intrusion detection system (IDS) is to find out intrusions among normal audit data and this can be considered as a classification problem. This problem is brought about by the user datagram protocol (UDP) which is a connectionless protocol that means it does not require a formal handshake to get the data flowing and has no need for SYNs, ACKs, FINs flags, or any other handshaking. Worms also make use of UDP protocol to connect or scan with other hosts. In this research, UDP scanning worm detection (UDPSWD) was proposed to detect UDP worm scanning by checking the failure message connections. UDPSWD focuses on the internet control message protocol (ICMP) unreachable, ICMP time exceeded and UDP is not responded to. The results show that UDPSWD is faster in comparison to other techniques, with no false positive or negative alarm.

Hybrid Trust Model for Worm Mitigation in P2P Networks

Passive worms spread so quickly in P2P networks that they can cause significant damage and serious security problems. To mitigate worm spreading, we used two classes of trust models: file-based trust and peer-based trust models. Peer-based trust provides to a peer the global trust values of all the other peers using the peers history of uploads. File trust provides to a peer the trust level of its sought file thanks to a process of voting. An hybrid trust model is introduced where we hybridize file-based and peer-based trust models. In this hybrid trust model, a requester peer checks firstly on the safety of the sought file (file trust) and then choose the most reputed peer from the set of peers that own the file (peer-based trust) for the downloading. A detailed simulation analysis is performed to study the performance of these trust models in terms of fraction of infected peers and number of infected downloaded files. Our results show that peer-based trusts could be used to mitigate the spread of worms in P2P networks because they limit downloading from malicious peers; but they are not effective in reducing the download rate of infected files from normal peers. Furthermore, we find that hybrid trust is an adequate security solution for mitigation of worm spreading in P2P network. Moreover, with comparison of several examples of peer-based trusts, we show that if we hybridize any peer-based trust with file trust, we obtain that the hybrid model is more efficient than this peer-based trust.

The Dynamical Modeling Analysis of the Spreading of Passive Worms in P2P Networks

Passive worms are prone to spreading through Peer-to-Peer networks, and they pose a great threat to the security of the network. In this paper, considering network heterogeneity and the number of hops a search can reach, we propose a novel mathematical model to study the dynamics of the propagation of passive worms. For the proposed model, the basic reproduction number R0 is derived by employing the existence of the positive equilibrium. And the stabilities of the worm-free equilibrium and positive equilibrium are analyzed. Moreover, we verify the rationality of the model established by comparing the stochastic simulation with the numerical simulation. Finally, we examine the effect of the number of hops on the spread of passive worms and discuss the various immunization strategies. We find that if R0>1, the propagation speed of passive worms is accelerated with the increase of hop count d; if R0<1, the number of infected peers decreases rapidly with the increase of the value of d and drops to zero eventually. Results show that the network topology and the number of hops can affect the spread of passive worms.