Internet Worms Research Articles

A Study on the Key Applications of Malware

Malware, a portmanteau of "malicious software," represents a significant threat in today's interconnected digital landscape. This abstract explores the multifaceted impacts of malware applications on individuals, organizations, and society at large. Types of malware include computer viruses, worms, Trojan horses, ransomware and spyware. These malicious programs steal, encrypt and delete sensitive data; alter or hijack core computing functions; and monitor end users' computer activity. malware jeopardizes individual privacy and security by surreptitiously infiltrating personal devices, often leading to identity theft, financial loss, and unauthorized access to sensitive information. Beyond personal repercussions, malware poses substantial risks to organizational integrity. It can compromise corporate networks, disrupt operations, and inflict substantial financial losses through data breaches, ransomware attacks, and intellectual property theft

Median Absolute Deviation for BGP Anomaly Detection

The stability and reliability of the global Internet infrastructure heavily rely on the Border Gateway Protocol (BGP), a crucial protocol that facilitates the exchange of routing information among various Autonomous Systems, ensuring seamless connectivity worldwide. However, BGP inherently possesses a susceptibility to abnormal routing behaviors, potentially leading to significant connectivity disruptions. Despite extensive efforts, accurately detecting and effectively mitigating such abnormalities persist as tough challenges. To tackle these, this article proposes a novel statistical approach employing the median absolute deviation under certain constraints to proactively detect anomalies in BGP. By applying advanced analysis techniques, this research offers a robust method for the early detection of anomalies, such as Internet worms, configuration errors, and link failures. This innovative approach has been empirically validated, achieving an accuracy rate of 90% and a precision of 95% in identifying these disruptions. This high level of precision and accuracy not only confirms the effectiveness of the statistical method employed but also marks a significant step forward for enhancing the stability and reliability of the global Internet infrastructure.

The impact of Caputo-Fabrizio fractional derivative and the dynamics of noise on worm propagation in wireless IoT networks

The main objective of this article on Wireless sensor network of the Internet of Things (IoT). The wireless network, B bluetooth network, infrared network, and other networks are the key components of the Internet of Things (IoT). The major emphasis of this work was on the impact of Caputo-Fabrizio fractional derivative on worm propagation in heterogeneous susceptible-exposed-infected-recovered wireless IoT devices. We first determined the equilibrium points and fundamental reproduction number for the Caputo-Fabrizio HSEIR system, and then we discussed the stability of the system at the worm propagation equilibrium point. Using the Picard-Lindeof method, we determine the existence and unique solution for the fractional CF system of the heterogeneous SEIR model. Next, we use fixed point theory to judge the stability of the iterative method. We investigate the impact of the derivative order on the behaviour of the resultant functions and acquired numerical values by computing the model's findings for various fractional orders. In addition, we compute the integer-order model's results and contrast them with the results of the fractional-order model. We develop a periodically intermittent controller driven by white noise with the amazing benefits of reduced cost and more adaptable control technique to restrict the spread of worms in wireless IoT networks. To clearly define the conditions for stability in probability one, we employ the stochastic analysis technique. Our results show that the nonlinear worm propagation system may be stabilised by intermittent stochastic perturbation under the parameters of intermittent time linked to stochastic perturbation strength. Our theoretical conclusions may be used to analyse the observable processes of the worm, design countermeasures to prevent its spread, and evaluate the consequences of various system parameters.

Dynamic properties of the multimalware attacks in wireless sensor networks: Fractional derivative analysis of wireless sensor networks

Abstract Due to inherent operating constraints, wireless sensor networks (WSNs) need help assuring network security. This problem is caused by worms entering the networks, which can spread uncontrollably to nearby nodes from a single node infected with computer viruses, worms, trojans, and other malicious software, which can compromise the network’s integrity and functionality. This article discusses a fractional S E 1 E 2 I R {\mathsf{S}}{{\mathsf{E}}}_{1}{{\mathsf{E}}}_{2}{\mathsf{I}}{\mathsf{R}} model to explain worm propagation in WSNs. For capturing the dynamics of the virus, we use the Mittag–Leffler kernel and the Atangana–Baleanu (AB) Caputo operator. Besides other characteristics of the problem, the properties of superposition and Lipschitzness of the AB Caputo derivatives are studied. Standard numerical methods were employed to approximate the Atangana–Baleanu–Caputto fractional derivative, and a detailed analysis is presented. To illustrate our analytical conclusions, we ran numerical simulations.

A novel method for the dynamics of worms in wireless sensor networks with fuzzy partition

Wireless sensor networks (WSNs) have gained much interest due to their enormous potential in civil and military applications. The power and radio communication capabilities of the sensor nodes are limited. Because sensor nodes have limited resources, they have weak defense capabilities and are attractive targets for software attacks. Worm-based cyberattacks are among the most significant threats to computers and WSNs’ security and integrity. In this article, a five-compartmental WSN epidemic model is considered. We conducted an investigation into equilibrium analysis and the reproductive number, followed by the development of a nonstandard finite difference numerical scheme for our model. The outcomes of our numerical simulations are then presented. This method yields reliable predictions, which can be valuable for regulators when making decisions related to designing and implementing control strategies. Furthermore, some interesting properties of the developed scheme are investigated, such as positivity, convergence, and consistency. The developed scheme preserves the essential characteristics of disease epidemic models like positivity, convergence, and consistency.

The Critical Role of NIDSNIPS in Protecting Internet Infrastructure

With the rapid development and wide application of the Internet, network security has become an important issue in modern society. Network attacks such as network worms, botnets and computer viruses are constantly emerging, bringing serious threats and economic losses to the Internet infrastructure. In this context, Network Intrusion Detection/Prevention System (NIDS/NIPS) plays a key role in protecting the Internet infrastructure. By monitoring network traffic in real time, NIDS/NIPS is able to detect and identify internal and external security intrusions in a timely manner and take appropriate measures for defense. Ensuring the high performance of NIDS/NIPS is an important topic in network security research, because the increase of Internet traffic and the variety of attacks make it face great challenges. In this paper, we will explore the fundamentals and functions of NIDS/NIPS and their key role in protecting the Internet infrastructure. We will also discuss key techniques to improve the performance of NIDS/NIPS and look at future directions in this area. An in-depth understanding and study of the theory and technology of NIDS/NIPS is an important reference for professionals in the field of network security.

On the Detection of Smart, Self-Propagating Internet Worms

On the Detection of Smart, Self-Propagating Internet Worms

Retraction Note: Joint detection and classification of signature and NetFlow based internet worms using MBGWO-based hybrid LSTM

Retraction Note: Joint detection and classification of signature and NetFlow based internet worms using MBGWO-based hybrid LSTM

Exploring The Effectiveness of Artificial Intelligence in Detecting Malware and Improving Cybersecurity in Computer Networks

Malware, in particular, has been identified as a major cy-bersecurity challenge due to its ability to infiltrate computer networks, steal sensi-tive data, and cause major damage to computer systems. The purpose of this study was to explore the effectiveness of artificial in-telligence in detecting malware and improving cybersecurity in computer net-works. Success rate in detecting and preventing malware attacks on computer networks using AI-based methods. The time it takes to detect and prevent malware attacks on computer net-works using AI-based cyber protection methods. Furthermore, the selection of two types of malware that are often found on computer networks, namely Trojans and Worms, and data sampling was then test-ed on a simulation system. In this study, three different AI techniques were applied, namely Support Vector Machine, Neural Network , and Decision Tree to detect malware on computer networks.

Self-Defending Networks

Abstract: As the nature of the threat in networks evolves daily, it is vitally important that defense techniques evolve as well. Earlier threats from both internal and external sources were gradual and can be easily tracked and destroyed. But now Internet worms are spread all over the world, so it is essential for protection systems and the network itself to respond immediately to threats. The basis of community self-defense is the importance of countering threats in the community. Every device found in a community plays a vital role in keeping the community safe. This guarantees the security of statistics and protects the community from internal and external threats. It identifies and responds to threats, isolates infected servers and structures, and then reconfigures the network in response to the attack. Self-Defending Networks are proactive and automated computer networks that are designed to detect, prevent, and respond to security threats. They use advanced technologies like machine learning, artificial intelligence, and behavioral analysis to monitor network traffic, identify potential security breaches, and take action to prevent them. By deploying SDNs, organizations can achieve a higher level of security for their networks and protect their assets from a wide range of cyber threats.

INFORMATION SECURITY AND CYBER SECURITY

In the era of digital transformation, the dependence on information technology services and products has increased significantly. Accordingly, the challenges in information security and cyber security have increased. Social distancing, while playing an important role in containing the spread of COVID-19, increases the risk of infected workstations, unauthorized access, data leakage, malicious code execution, and all the types of risks that come with working in a vulnerable environment. Computer security, cyber security or information security - protection of computer systems and control points of networks from its interference, unauthorized use or damage to hardware, software and electronic data, as well as from destruction and violation of the services they provide to users. This area is becoming more and more important for computer systems, the Internet and wireless networks such as Bluetooth and Wi-Fi. Because of its complexity, in terms of politics and technology, cyber security is also one of the main challenges in modern life. Cyber security is one of the most important fields in today's world. This branch is connected with such demanding professions and specialties as: security analyst, security engineer, security architect, security administrator, security specialist, consultant, etc. Types of Malware - Malware (Malware); computer virus; mobile media means; Trojan (Trojan Horse); rootkit; Backdoor (Backdoor); Worm (Computer worm); Keylogger (Keylogger). In 2003, the computer virus Slammer penetrated the management system of the electric distribution network and slowed down its operation, which also caused the speed of management to slow down. As a result, even a small incident like a tree falling on a power line can set off a serious chain reaction. In particular, in the US state of Ohio, the voltage began to change, and the equipment, which was installed to prevent the cascade effect, failed to isolate the high voltage area in time. As a result, 8 US states, 2 Canadian provinces (a total of 50 million people) were left without electricity and services dependent on it. This example shows what can result from a little carelessness, ignoring security issues, in the digital information space. Today, cyber security is at risk like never before.

ON DISCRETE-TIME MODELS OF NETWORK WORM PROPAGATION GENERATED BY QUADRATIC OPERATORS

In this paper we consider the discrete-time dynamical systems generated by network worm propagation models based on the theory of quadratic stochastic operators(QSO). This approach simultaneously solves two important problems: exploring of the QSO trajectory‘s behavior, we described the set of limit points, thereby completely solved the main problem of dynamical systems (i), we showed a new application of the theory QSOs in worm propagation modelling (ii). We demonstrated that proposed discrete-time biologically-inspired model represents also realistic picture of the worm propagation process and such analytical models can be used in decision of some problems of computer networks.

Dynamic analysis and optimal control of worm propagation model with saturated incidence rate

In order to prevent the propagation of computer worms effectively, based on the latent character of worms, the exposed compartments of computer and USB device are introduced respectively, and a series of computer worm propagation models with saturation incidence rate are proposed. The qualitative behavior of the proposed model is studied. Firstly, the threshold R0 of the model is derived by using the next-generation matrix method, which completely characterized the stability of disease free equilibrium and endemic equilibrium. If R0 < 1, the disease free equilibrium is asymptotically stable, implying that the worm dies out eventually and its attack remains under control; if R0 > 1, the asymptotic stability of endemic equilibrium under certain conditions is proved, which means that the worm is always persistent and uncontrollable under such conditions. Secondly, the theoretical results are verified by numerical study, in which the relative importance of each parameter in worm prevalence is evaluated by sensitivity analysis. Finally, so as to minimize the number of computer and USB device carrying computer worms in short span of time, the worm propagation model is extended to incorporate three control strategies. The Pontryagin’s maximum principle is used to characterize the controls’ optimal levels. According to the control effect diagram, the combined strategy is effective in minimizing the transmission dynamics of worm virus in computer and USB devices populations respectively.

Detecting Network Scanning Through Monitoring and Manipulation of DNS Traffic

In this paper, we propose an approach for detecting internal and external network scanning attacks on enterprise networks. In our approach, an inline scan detection system (SDS) monitors the ingress and egress flows of an enterprise network subnet and detects scanning probes based on the correlation of flows with preceding DNS query/responses and reducing TTL values of DNS Resource Records (RR). Through rigorous evaluation, we show that our method is effective against both external and internal port scanners and network worms, its effectiveness is independent of scanning rate or technique, and its deployment incurs negligible overhead on DNS and network response times. While the idea of detecting scans by correlating network flows with preceding DNS query/responses has been proposed in the literature, this work extends the state-of-the-art by offering four contributions: 1) we show that without decreasing TTL values of RRs in DNS responses, attackers can piggyback on cached DNS records to bypass our detection; thus we incorporate a TTL reduction mechanism to enhance the effectiveness of this approach, especially against stealthy and adaptive scanners; 2) while prior works work against internal scanners, we use the relatively new extension of DNS protocol, ENDS0 Client Subnet (ECS) option, to expand this approach toward detecting external scanners; 3) we present a novel adaptive scanning technique, called DNS-cache-based scanning, that exploits local DNS cache to bypass prior detection methods, and shows that, while prior approaches fail to defeat this threat model, our approach is effective against this evolved threat model as well; and 4) contrary to existing work that focuses on defeating fast network scanning worms, this approach is effective against any scanning, including stealthy scanning that uses conservative timing profiles to evade detection.

Neural networking study of worms in a wireless sensor model in the sense of fractal fractional

<abstract><p>We are concerned with the analysis of the neural networks of worms in wireless sensor networks (WSN). The concerned process is considered in the form of a mathematical system in the context of fractal fractional differential operators. In addition, the Banach contraction technique is utilized to achieve the existence and unique outcomes of the given model. Further, the stability of the proposed model is analyzed through functional analysis and the Ulam-Hyers (UH) stability technique. In the last, a numerical scheme is established to check the dynamical behavior of the fractional fractal order WSN model.</p></abstract>

Stability analysis and optimal control of worm propagation model with saturated incidence rate

Worms spreading through Web-based scanning and removable devices pose a serious threat to Internet security. This paper is devoted to solving the problems of computer worms. A nonlinear mathematical model of the problem is established, and the characteristics and mechanisms of worm propagation are analyzed by means of the stability theory of differential equations, optimal control and computer simulation. The results provide some new insights to computer security, which is to predict the tendency of worm propagation through the stability of endemic equilibrium, identify the epidemic control strategies by the stability of disease-free equilibrium, and evaluate the prevalence of worms based on the final scale of infected devices. The performance of our model is evaluated by numerical simulation, and the results indicate that our combined strategy can combat the worm propagation. The results may be helpful to inhibit the worm spread widely in the network.

A Review of Security and Privacy Concerns in the Internet of Things (IoT)

The recent two decades have witnessed tremendous growth in Internet of things (IoT) applications. There are more than 50 billion devices connected globally. IoT applications’ connectivity with the Internet persistently victimized them with a divergent range of traditional threats, including viruses, worms, malware, spyware, Trojans, malicious code injections, and backdoor attacks. Traditional threats provide essential services such as authentication, authorization, and accountability. Authentication and authorization are the process of verifying that a subject is bound to an object. Traditional authentication and authorization mechanisms use three different factors to identity a subject to verify if the subject has the right capability to access the object. Further, it is defined that a computer virus is a type of malware. Malware includes computer viruses, worms, Trojan horses, spyware, and ransomware. There is a high probability that IoT systems can get infected with a more sophisticated form of malware and high-frequency electromagnetic waves. Purpose oriented with distinct nature IoT devices is developed to work in a constrained environment. So there is a dire need to address these security issues because relying on existing traditional techniques is not good. Manufacturers and researchers must think about resolving these security and privacy issues. Most importantly, this study identifies the knowledge and research gap in this area. The primary objective of this systematic literature review is to discuss the divergent types of threats that target IoT systems. Most importantly, the goal is to understand the mode of action of these threats and develop the recovery mechanism to cover the damage. In this study, more than 170 research articles are systematically studied to understand security and privacy issues. Further, security threats and attacks are categorized on a single platform and provide an analysis to explain how and to what extent they damage the targeted IoT systems. This review paper encapsulates IoT security threats and categorizes and analyses them by implementing a comparative study. Moreover, the research work concludes to expand advanced technologies, e.g., blockchain, machine learning, and artificial intelligence, to guarantee security, privacy, and IoT systems.

RETRACTED ARTICLE: Joint detection and classification of signature and NetFlow based internet worms using MBGWO-based hybrid LSTM

RETRACTED ARTICLE: Joint detection and classification of signature and NetFlow based internet worms using MBGWO-based hybrid LSTM

MFMCNS: a multi-feature and multi-classifier network-based system for ransomworm detection

Ransomware is a type of advanced malware that can encrypt a user’s files or lock a computer system until a ransom has been paid. Ransomworm is a type of malware that combines the payload of ransomware with the propagation feature of a computer worm. Most host-based detection methods require the host to be infected and the payload to be executed first to be able to identify anomalies and detect the malware. By the time of infection, it might too late as some of the system’s assets would have been already encrypted or exfiltrated by the malware. On the contrary, the network-based methods can be one of the crucial means in detecting ransomworm activities when it attempts to spread to infect other networks before executing the payload. Therefore, a thorough analysis of ransomworm network traffic can be one of the essential means for early detection. This paper presents a comprehensive behavioral analysis of ransomworm network traffic, taking WannaCry, which launched a worldwide cyberattack, and NotPetya as a case study. Two sets of related features were extracted based on two independent flow levels: session-based and time-based. On top of each set, an independent classifier was built. Moreover, to improve the reliability, a multi-feature and multi-classifier network-based system, MFMCNS, has been proposed. MFMCNS employs these classifiers working in parallel on different flow levels, then it adopts a fusion rule to combine the classifiers’ decisions. The experimental results prove that MFMCNS is reliable and has high detection accuracy.

Intrusion Detection System Based on Ada boosting and Bagging Algorithm

Computer worms execute damaging functions in the network systems, compromising system security. Although researchers use a variety of methods to detect worms and prevent their spread. Detecting worms remains a challenge for the following reasons: First, a huge volume of irrelevant data affects classification accuracy. Second, frequently used individual classifiers in systems are poor at detecting all types of worms, Third, many systems are built on out-of-date information, rendering them useless for new worm species. As a result, providing a network intrusion detection system is vital for ensuring security and reducing the harm caused by worms on networks to information systems. The goal of the study is to discover computer worms in the computer networks and protect the systems from their damages. The proposed method uses the UNSW NB15 dataset to train and test the ensemble Ada boosting and Bagging algorithms with the Support Vector Nachine (SVM) as a contribution rather than a decision tree. Due to Correlation Feature Selection (CFS) identifying relationships between features and classes, and Chi-square (Chi2) determining whether features and classes are independent or not, we combined these two algorithms as a contribution in a method called CFS&Chi2fs to select the relevant features and reduce the time. The system achieved accuracy reaching 0.998 with Bagging(SVM), and 0.989 with Ada boost(SVM). Index Terms— Intrusion Detection System, Computer Worms, Ada boosting, Bagging.