Internet Worms Research Articles

Malicious Traffic Detection and Containment based on Connection Attempt Failures using Kernelized ELM with Automated Worm Containment Algorithm

Objectives: In the world of Internet today, most of the communications are done through Internet applications. Rapidly with the growth of Internet, the security threat on Internet is also increasing. Internet worms are one of the serious dangerous threats heavy financial losses. To overcome these damages, the proposed methodology provide better defense mechanism through Internet worm detection and containment schemes based on connection attempt failures characteristic. Method: The Internet worm detection is done using the Machine Learning Method based on Anomaly detection schemes and containment based on blocking schemes. The proposed kernelized Extreme Learning Machine with Automated Worm Containment Algorithm (kEA) method is used for detection and containment of malicious traffic from non-existing IP addresses based on connection attempt failures. Findings: Second channel based propagation through botnet worms propagates illegal traffic from malicious IP addresses through connection attempt failures. This traffic is transferred through TCP and UDP transmission schemes. The proposed work is used to identify the second channel propagating worms and containment of malicious traffic. Improvement: The proposed kernelized Extreme Learning Machine (kELM) method achieved detection accuracy improved by 23.67%. Then proposed kEA method blocks all the detected malicious IP addresses with 100% containment at the time span of 33 ms.

A Review on Hot-IP Finding Methods and Its Application in Early DDoS Target Detection

On the high-speed connections of the Internet or computer networks, the IP (Internet Protocol) packet traffic passing through the network is extremely high, and that makes it difficult for network monitoring and attack detection applications. This paper reviews methods to find the high-occurrence-frequency elements in the data stream and applies the most efficient methods to find Hot-IPs that are high-frequency IP addresses of IP packets passing through the network. Fast finding of Hot-IPs in the IP packet stream can be effectively used in early detection of DDoS (Distributed Denial of Service) attack targets and spreading sources of network worms. Research results show that the Count-Min method gives the best overall performance for Hot-IP detection thanks to its low computational complexity, low space requirement and fast processing speed. We also propose an early detection model of DDoS attack targets based on Hot-IP finding, which can be deployed on the target network routers.

Worm Propagation with Differential Infectivity under Quarantine Control Strategy

Malwares have sharp resemblance with the biological pathogens in terms of propagation. Biological pathogens spread from one living being to another in very short span of time. Similarly malwares also propagate rapidly from one host to another host and one network to another network, in order to spread infection in major scale. This spread can be epidemic if control strategies are not called in time. In order to timely intervene, study of epidemic behavior is very important. In this paper we develop SI1I2Q1Q2R1R2 model of worm propagation under quarantine control strategy. We have considered different infective, quarantined and recovered (or removed) group in our model. The motivation of such model came from the study of propagation dynamics of HIV. Our worm propagation and its quarantined based defense is based on stagedprogression (SP) hypothesis of HIV. We have studied in this paper the stability of worm free equilibrium condition and analyzed the epidemic state condition in terms of reproduction number. When reproduction number is greater than one the worm propagation become epidemic. If it is less than one then infection diminishes. Extensive analysis and simulation has been done to validate our system. Simulation result shows that effective quarantine strategy helps in controlling the epidemic outbreak of worms in networks.

Anomaly Detection Using the Dempster-Shafer Method

In this paper, we implement an anomaly detection system using the Dempster-Shafer method. Using two standard benchmark problems we show that by combining multiple signals it is possible to achieve better results than by using a single signal. We further show that by applying this approach to a real-world email dataset the algorithm works for email worm detection. Dempster-Shafer can be a promising method for anomaly detection problems with multiple features (data sources), and two or more classes.

A stochastic worm model

Internet worm infection continues to be one of top security threats and has been widely used by botnets to recruit newbots. In order to defend against future worms, it is important to understand how worms propagate and how different scanning strategies affect worm propagation dynamics. In our study, we present a (stochastic) continuous-time Markov chain model for characterizing the propagation of Internet worms. The model is developed for uniform scanning worms, and further for local preference scanning worms and flash worms. Specifically, for uniform and local preference scanning worms, we are able to (1) provide a precise condition that determines whether the worm spread would eventually stop and (2) obtain the distribution of the total number of infected hosts. By using the same modeling approach, we reveal the underlying similarity and relationship between uniform scanning and local preference scanning worms. Finally, we validate the model by simulating the propagation of worms.

Design and analysis of SEIQR worm propagation model in mobile internet

The mobile Internet has considerably facilitated daily life in recent years. However, it has become the breeding ground for lots of new worms, including the Bluetooth-based worm, the SMS/MMS-based worm and the Wi-Fi-based worm. At present, Wi-Fi is widely used for mobile devices to connect to the Internet. But it exposes these devices to the dangerous environment. Most current worm propagation models aim to solve the problems of computer worms. They cannot be used directly in the mobile environment, particularly in the Wi-Fi scenario, because of the differences between computers and mobile devices. In this paper, we propose a worm propagation model in the Wi-Fi environment, called SEIQR (Susceptible-Exposed-Infectious- Quarantined-Recovered). In the model, infected nodes can be quarantined by the Wi-Fi base station, and a new state named the Quarantined state (Q) is established to represent these infected nodes. Based on this model, we present an effective method to inhibit the spread of the Wi-Fi-based worms. Furthermore, related stabilities of the worm-free and endemic equilibriums are studied based on the basic reproduction number R0. The worm-free equilibrium is locally and globally asymptotically stable if R0 < 1, whereas the endemic equilibrium is locally asymptotically stable if R0 < 1. Finally, we evaluate the performance of our model by comprehensive experiments with different infection rates and quarantine rates. The results indicate that our mechanism can combat the worms propagated via Wi−Fi.

NADTW: new approach for detecting TCP worm

A computer worm is a self-replicating malicious code that does not alter files but resides in active memory where it duplicates itself. Worms use parts of the operating system that are automatic and usually invisible to the user. Worms commonly exhibit abnormal behaviors, which become noticeable only when their uncontrolled replication consumes system resources and consequently decelerates or halts other tasks completely. This paper proposes an effective approach for detecting the presence of TCP network worms. This approach consists of two phases: Statistical Cross-relation for Network Scanning (SCANS) phase and the Worm Correlation phase. The SCANS phase is used to detect the presence of the network scanning behavior of a network worm, while the worm correlation phase is used to detect the Destination Source Correlation (DSC) behavior of the network worm. The proposed approach has been tested with a simulated dataset obtained from the GTNetS simulator. The numerical results showed that the proposed approach is efficient and outperforms the well-known DSC approach in terms of detecting the presence of TCP network worm.

A Decision-Theoretic Approach to Network Fault Diagnosis and Follow-up Action

Fault management and security of computer networks present new challenges of increasing complexity. Decision procedures for fault diagnosis, security-related threats, and follow-up actions must, however, be evaluated on the basis of sound theoretical foundations and economic costs of various strategies. This paper presents a minimum expected cost solution for fault diagnosis and corrective actions. Several notions new to fault management are introduced. The methodology is applicable to both non-malicious and malicious faults. As a novel security-related application, the problem of choosing between two strategies for containing the spread of network worms is discussed.

Design and Development of Humiliating of C-Worm Utilizing an Arbitrary Visualizing

A worm is a malicious self-replicating programs, it is intended to feast via computer links. The computer worms are one method of malware beside with Trojans and Viruses. The active worms impersonate main refuge threats to that an Internet. This is the ability of active worms to continuously propagate in the computers on the Internet as an automated fashion. The Active worms changes through their circulation, and thus, pose large tasks to preserve alongside them. This manuscript, to explore an original class of active worms, denoted to as Camouflaging Worm (Abbreviated to as C-Worm) respectively. The C-Worm means different from traditional worms because of its ability to intelligently manipulate its scan traffic size over time respectively. So, the C-Worm camouflages its circulation from prevailing worm detection systems constructed on investigating the circulation traffic produced by worms respectively. To analyze characteristics of the C- Worm and conduct a comprehensive comparison between its non-worm traffic and traffic respectively. To detect that these double kinds of traffic are barely different in the time sphere. Though, their difference is clear in the incidence sphere, due to the periodic devious environment of the C-Worm respectively. Interested by these clarifications, it designs a novel spectrum-constructed pattern to detect the C-Worm. This pattern consumes the Power Spectral Density (PSD) circulation of the scan traffic size and its corresponding Spectral Flatness Measure (SFM) respectively, to distinguish the C-Worm traffic from related traffic. Consuming a complete group of detection metrics and real-world suggestions as contextual traffic, it directs widespread implementation estimates on these planned spectrumconstructed detection pattern. This implementation data evidently establishes that this pattern can efficiently detect the C-Worm circulation. Besides, to display the simplification of this spectrum-based pattern in efficiently detecting not only the C-Worm, although conventional worms also.

Stability Analysis of a Worm Propagation Model with Quarantine and Vaccination

Internet worms pose a serious threat to the Internet security. In order to effectively defend against Internet worms, this paper proposes a novel epidemic ＂e-SEIQV＂ model with quarantine and vaccination. Using this ＂e-SEIQV＂ model, we obtain the basic reproduction number for deter- mining whether the worm dies out completely. The global stability of the worm-free equilibrium and the local stability of endemic equilibrium are proved, and determined by the basic reproduction number. Besides the impact of different parameters of this model is studied. Simulation results show that the number of susceptible and infected hosts are consistent with the theoretical analysis. The model provides a theoretical foundation for controlling and forecasting Internet worms.

Improving sensor network immunity under worm attacks: A software diversity approach

Because of cost and resource constraints, sensor nodes do not have a complicated hardware architecture or operating system to protect program safety. Hence, the notorious buffer-overflow vulnerability that has caused numerous Internet worm attacks could also be exploited to attack sensor networks. We call the malicious code that exploits a buffer-overflow vulnerability in a sensor program sensor worm. Clearly, sensor worm will be a serious threat when an attacker could simply send a single packet to compromise the entire sensor network. Despite its importance, so far little work has focused on sensor worms.In this work, we first illustrate the feasibility of launching sensor worms through trial experiments on Mica2 motes. Inspired by the survivability through heterogeneity philosophy, we then explore the technique of software diversity to combat sensor worms. Given a limited number of software versions, we design an efficient algorithm to assign the appropriate version of software to each sensor, so that sensor worms are restrained from propagation. We also examine the impact of sensor node deployment errors on worm propagation, which directs the selection of our system parameters based on percolation theory. We then extend the above scheme by considering enhanced sensors that can load multiple program versions. We show that the existence of enhanced sensors could further improve the immunity and robustness of sensor networks under worm attacks. Finally, extensive analytical and simulation results confirm the effectiveness of our schemes in various settings.

A state feedback impulse model for computer worm control

Computer worm is a worldwide threat to the safety of Internet, which caused billions of dollars in damages over the past decade. Software patches have been widely used as one of approaches to protect computers against computer worms. In this study, an impulsive state feedback model was employed to study the transmission of computer worm and the preventive effect of operating system patching. The existence of order-1 periodic solution and its stability were proved with a novel method. The results demonstrated that the application of software patches is an effective approach to constrain the deluge of computer worm. Numerical simulation results were presented to support the theoretical analysis.

An SVEIR Defending Model with Partial Immunization for Worms.

Internet worms can propagate across networks horrendously, reduce network security remarkably, and cause economic losses heavily. How to quickly eliminate the Internet worms using partial immunization becomes a big issue for sustaining Internet infrastructure smoothly. This paper addresses this issue by presenting a novel worm attack model through incorporating a saturated incidence rate and a partial immunization rate, named SVEIR model. Using the basic reproduction number, we derive the global stability of the infection-free equilibrium and local stability of the unique endemic equilibrium. Numerical methods are employed to solve and simulate the developed system and also verify the proposed SVEIR model. Simulation results show that the partial immunization is highly effective for eliminating worms.

The cost optimal control system based on the Kermack–Mckendrick worm propagation model

Although the network worm propagation models are able to predict trends in the spread of the worm, these papers did not consider the economic losses caused by the worm propagation. This paper uses the Hamiltonian approach of the optimal control theory and proposes the cost optical control system based on the Kermack–Mckendrick worm propagation model. In the cost optical control system, we control and process the infectious hosts. In this paper, we present an optimization model that takes into account infection cost and treatment cost. The simulation on the cost optical control system is carried out, and then the results of the analysis are given. In conclusion, the cost optical control system of the Kermack–Mckendrick model can provide the optical control of the worm propagating and effectively reduce the worm propagation with minimum cost.

A Decoy Framework to Protect Server from Wireless Network Worms

Intrusion is the primary step to conduct various kinds of network attacks. Most of the intrusion detection and intrusion prevention systems (IDPS) that make use of signature can detect only known attacks, but cannot save resources from new form of attacks like internet worms. Thus, it is necessary to collect information about unknown intrusion dynamically. Honeypots are useful security mechanism that deliberately lure intruders to probe, attack or compromise the systems. This paper presents an agent based honeymesh for protecting the network resources like servers from intrusion related attacks. In our strategy, agent programs make use of decoyports to lure intruders and redirects to honeymesh to understand attackers' activities. Also, the agents remove malicious processes and executable files on compromised server as soon as honeypots alerts those intrusions. This novel defense mechanism detects and removes new kinds of internet worms without using signatures.

Predator-Prey Models on Interaction between Computer Worms, Trojan Horse and Antivirus Software Inside a Computer System

In this paper an attempt has been made to develop Predator- prey Models on interaction between Computer worms, Trojan horse and antivirus software inside a computer system. Five mathematical models are proposed to study the Predator-prey system inside a computer system. In mathematical model 1, the prey consists of uninfected files, whereas, the predator consists of computer worms. In mathematical model 2, the infected files constitute the prey and anti-virus software is the predator. In mathematical model 3, Effect of new or updated antivirus software on such computer worms which are quarantine or not completely recovered by the lower version of installed antivirus software in the system is studied which switches the rate of infection to zero. In mathematical model 4, Reactivation of computer worms when they are in the latent class is mathematically formulated. In mathematical model 5, we have attempt to develop and understand the recent attack of the Trojan horse Backdoor. Kihomchi and Trojan.Zbot!gen74 and its removal by newly available tool NPE.exe. The stability of the result is stated in terms of the Jacobian of the system and the basic reproduction number is also well defined for all models. Numerical methods and MATLAB are employed to solve and simulate the system of equations developed and analysis of the models gives remarkable exposure.

Limiting Self-Propagating Malware Based On Connection Failure Behavior Through Hyper-Compact Estimators

Self-propagating malware (e.g., an Internet worm) exploits security loopholes in software to infect servers and then use them to scan the Internet for more vulnerable servers. While the mechanisms of worm infection and their propagation models are well understood, defense against worms remains an open problem. One branch of defense research investigates the behavioral difference between worm-infected hosts and normal hosts to set them apart. One particular observation is that a worm-infected host, which scans the Internet with randomly selected addresses, has a much higher connection-failure rate than a normal host. Rate-limit algorithms have been proposed to control the spread of worms by traffic shaping based on connection failure rate. However, these rate-limit algorithms can work properly only if it is possible to measure failure rates of individual hosts efficiently and accurately. This paper points out a serious problem in the prior method. To address this problem, we first propose a solution based on a highly efficient double-bitmap data structure, which places only a small memory footprint on the routers, while providing good measurement of connection failure rates whose accuracy can be tuned by system parameters. Furthermore, we propose another solution based on shared register array data structure, achieving better memory efficiency and much larger estimation range than our double-bitmap solution.

Root cause diagnosis in error‐propagating networks

AbstractVarious types of errors can propagate in networks, and they are usually hard to diagnose. For example, social networks spread rumors as well as useful information. Computer networks can spread Internet worms or malicious packets. In many cases, it is very hard to find the root cause (a.k.a. initial rumor spreader) of such errors without complete knowledge of the error propagation. We aim to find the root cause node when there is limited information about error propagation. We assume that there are very small number of monitor nodes in the network reporting whether error reached them or not. With this assumption, we first propose an algorithm that finds the most probable root cause node. Second, to improve the accuracy of root cause analysis, we propose another algorithm that makes use of timestamp of error reception. Finally, we study how to select monitors effectively so that root cause analysis can be accurate. With real networks from various domains, our algorithms are shown to be very effective. Copyright © 2016 John Wiley &amp; Sons, Ltd.

NEDAC: A worm countermeasure mechanism

This article presents an Internet worm countermeasure mechanism that uses DNS activities as a behavioural technique to detect worm propagation. The mechanism also uses a data-link containment solution to block traffic from an infected host. The concept has been demonstrated using a developed prototype and tested in a virtualised network environment. An empirical analysis of network worm propagation has been conducted to test the capabilities of the developed countermeasure mechanism. The results show that the developed mechanism is sensitive in containing Internet worms. Keywords : Worm Detection, Malware, cyber defense

A Stochastic Model for the Size of Worm Origin

Computer worms have infected millions of computers since the 1980s. For an incident handler or a forensic investigator, it is important to know whether the worm attack to the network has been initi...