Internet Worms Research Articles

Darknet as a Source of Cyber Intelligence: Survey, Taxonomy, and Characterization

Today, the Internet security community largely emphasizes cyberspace monitoring for the purpose of generating cyber intelligence. In this paper, we present a survey on darknet. The latter is an effective approach to observe Internet activities and cyber attacks via passive monitoring. We primarily define and characterize darknet and indicate its alternative names. We further list other trap-based monitoring systems and compare them to darknet. Moreover, in order to provide realistic measures and analysis of darknet information, we report case studies, namely, Conficker worm in 2008 and 2009, Sality SIP scan botnet in 2011, and the largest amplification attack in 2014. Finally, we provide a taxonomy in relation to darknet technologies and identify research gaps that are related to three main darknet categories: deployment, traffic analysis, and visualization. Darknet projects are found to monitor various cyber threat activities and are distributed in one third of the global Internet. We further identify that Honeyd is probably the most practical tool to implement darknet sensors, and future deployment of darknet will include mobile-based VOIP technology. In addition, as far as darknet analysis is considered, computer worms and scanning activities are found to be the most common threats that can be investigated throughout darknet; Code Red and Slammer/Sapphire are the most analyzed worms. Furthermore, our study uncovers various lacks in darknet research. For instance, less than 1% of the contributions tackled distributed reflection denial of service (DRDoS) amplification investigations, and at most 2% of research works pinpointed spoofing activities. Last but not least, our survey identifies specific darknet areas, such as IPv6 darknet, event monitoring, and game engine visualization methods that require a significantly greater amount of attention from the research community.

Comparative Performance of a Parallel Implementation of an Internet-Scale Zero-Day Worm Epidemiology Simulator

The threat posed by fast-spreading malware is significant, particularly given the fact that network operator/administrator intervention is not likely to take effect within the typical epidemiological timescale of such infections. The cost of zero-day network worm outbreaks has been estimated to be up to US $2.6 billion for a single worm outbreak. Zero-day network worm outbreaks have been observed that spread at a significant pace across the global Internet, with an observed rate of reaching more than 90 percent of vulnerable hosts within 10 minutes. An accepted technology that is used in addressing the security threat presented by zero-day worms is the use of simulation systems, and a common factor determining their efficacy is their performance. An empirical comparison of a sequential and parallel implementation of a novel simulator, the Internet Worm Simulator (IWS), is presented detailing the impact of a selection of parameters on its performance. Experimentation demonstrates that IWS has the capability to simulate up to 91.8 million packets transmitted per second (PTS) for an IPv4 address space simulation on a single workstation computer, comparing favourably to previously reported metrics. It is concluded that in addition to comparing PTS performance, simulation requirements should be taken into consideration when assessing the performance of such simulators.

복수 인터넷 웜의 확산 방식 연구

Internet worms have been the major Internet threats may disclose important information and can bring about faults of computer systems, which spread with the fastest speed among malicious codes. Simultaneously spreading multiple worms and its variants are revealing the limitation of conventional responses based on single worms. In order to defend them effectively, it is necessary to study how multiple worms propagate and what factors affect worm spreading. In this paper, we improve the existed single worm spreading models and try to describe the correct spreads of multiple worms. Thus we analyze the spreading effects of multiple worms and its variants by various experiments.

Petri Net and Probabilistic Model Checking Based Approach for the Modelling, Simulation and Verification of Internet Worm Propagation.

Internet worms are analogous to biological viruses since they can infect a host and have the ability to propagate through a chosen medium. To prevent the spread of a worm or to grasp how to regulate a prevailing worm, compartmental models are commonly used as a means to examine and understand the patterns and mechanisms of a worm spread. However, one of the greatest challenge is to produce methods to verify and validate the behavioural properties of a compartmental model. This is why in this study we suggest a framework based on Petri Nets and Model Checking through which we can meticulously examine and validate these models. We investigate Susceptible-Exposed-Infectious-Recovered (SEIR) model and propose a new model Susceptible-Exposed-Infectious-Recovered-Delayed-Quarantined (Susceptible/Recovered) (SEIDQR(S/I)) along with hybrid quarantine strategy, which is then constructed and analysed using Stochastic Petri Nets and Continuous Time Markov Chain. The analysis shows that the hybrid quarantine strategy is extremely effective in reducing the risk of propagating the worm. Through Model Checking, we gained insight into the functionality of compartmental models. Model Checking results validate simulation ones well, which fully support the proposed framework.

A stochastic model for the size of worm origin

Computer worms have infected millions of computers since the 1980s. For an incident handler or a forensic investigator, it is important to know whether the worm attack to the network has been initi...

BADUW: Behavioural based Approach for Detecting UDP Worm

A worm is a self-propagating, self-duplicating malicious code that spread without human intervention in computer networks and attacks vulnerable hosts. The severity of network worms depends on the propagation process that degrades the network performance and consume bandwidth and resource (CPU and memory). Thus, this paper presents a behavioral approach for UDP worm (worm uses UDP as transmission mechanism) detection based on scanning and Destination Source Correlation (DSC) behaviors of worm. The proposed approach consists of two sub approaches which are: 1. Statistical Cross-relation Approach for Network Scanning detection (SCANS) approach that is used to detect the presence of network scanning behavior of worm and 2. Worm correlation approach that is used to detect Destination-Source Correlation (DSC) behavior of worm. These behaviors have been chosen among other worm behaviors due to its anomaly behaviors that are clearly exhibit in the network. A salient feature of this approach is that it effective for detecting scanning DSC behaviors of worm with high accuracy. The proposed approach is evaluated with the simulated dataset obtained from Georgia Tech Network Simulator (GTNetS) simulator and confirmed that our approach is efficient in detecting UDP worm than the existing approach.

SMS Worm Propagation Over Contact Social Networks: Modeling and Validation

Nowadays, short message service (SMS) worms have been discovered to propagate themselves via victims’ contact lists by sending malicious text messages. Correspondingly, defenders need to analyze and model the dynamics of these worms to lessen their potential threat. However, the existing worm propagation models, which almost generate the similar curves of an exponential smooth rise, cannot well explain the infection dynamics of real-world SMS worms, which exhibits an uneven wave-like uplift. Motivated by this observation, we formalize the general infection process of SMS worms in contact social networks, and propose a novel analytical model based on stochastic processes. In contrast to previous models, our model not only considers the different and asymmetrical relationships between mobile users by modeling the node reputation and the edge trust degree, but also describes the user behavior of checking messages by introducing two susceptible states. Moreover, the strong assumptions in previous works are eliminated by determining related components based on extensive statistical investigations. Afterward, both real-world SMS worms and artificial ones are utilized in validation and comparison experiments, and the results show that our model is more suitable for describing the propagation of these sophisticated worms, compared with the state-of-the-art models. In addition, we study on the impacts of key factors and give some interesting discoveries.

Numerical Approaching of SIR Epidemic Model for Propagation of Computer Worms

In this paper we analyzed the model susceptible-infected-recovered (SIR); this model is based on differential equations, in this sense it cannot be implemented directly on a computer, in this context as motivation of the study presented, we propose an approximate model based on finite difference equations to achieve a simulation of the epidemic, using for this set theory and cardinality obtaining an iterative numerical method which consists on basics arithmetic operations, in addition, to be an approximate model, it will present an error due to truncation or rounding. At the end of this paper it is presented a case of study developed in SIMULINK of MATLAB software, and the results of the model based on difference equations.

Detection and Prevention to Network Worm Virus Based on Segmentation Algorithm

This paper Through an analysis of the worm propagation behavior, found that there are certain constraints relationship of network size to the propagation speed of the worm . On this basis, network segmentation algorithm based on DFS is proposed to reduce the size of the network, in order to gain subnet boundaries , in order to further suppress the spread of worms provide a theoretical basis , provide reference and basis for the erection of a network worm isolation system. the method of using DFS network segmentation algorithm based on network topology was proposed to solve large-scale network analysis. It provides a strong theoretical support for fast access network backbone node. The result of experiment shows that the proposed method is effective.

Fast detecting Hot-IPs in high speed networks

Hot-IPs, hosts appear with high frequency in networks, cause many threats for systems such as denial of service attacks or Internet worms. One of their main characteristics is quickly sending a large number of packets to victims in a short time in network. This paper presents a solution to find Hot-IPs by using non-adaptive group testing approach. The proposed solution has been implemented in combination with the distributed architecture and parallel processing techniques to quickly detect Hot-IPs in ISP networks. Experimental results can be applied to detect Hot-IPs in ISP networks.

Proportionality in CyberWarfare

In June 2010, a computer worm called Stuxnet was discovered. Soon it was revealed that Stuxnet was specifically designed to attack nuclear facilities in Iran. It is claimed that this cyber attack caused mass damage in nuclear facilities of Iran namely Natanz facility. This so called cyber attack arise the question of weather Iran could use it’s right of self-defence or not? And if it can, how far it can goes. Does this attack give Iran right to bomb attackers if identified or it should limit itself to counter cyber attacks (Hack back)? This latter question is in issue in this paper.Self-defense in cyber attacks: Customary International Law (CLI) established that every states has right to undertake Self-defense measures when an adversary commits an “armed attack”. Not every cyber attack constitute an armed attack but those who enjoy “sufficient scope, duration, and intensity” can constitute it and if so there is no doubt that under CLI the state who was victim of these kind of attacks can practice it’s right to defend itself. Jus in bello rules over these measure and so they are limited to necessity and proportionality. The principle of necessity requires that any measure taken avowedly in Self-defense must have been necessary for that purpose. One of main requirement in the principle of necessity is actions taken in Self-defense must generally be taken without undue delay. In cyber attacks this requirement is not at issue as in most cases identifying cause of attack may take time. As a result nature of cyber attacks require that immediate action requirement should not strictly applied. Instead state should given enough time to practice its right of Self-defense.

The Temporal Characteristic of Human Mobility: Modeling and Analysis of Social Worm Propagation

A common view of modeling social worm propagation is topology construction for social networking layer and human behavior modeling for message checking activity. However, due to the existence of human mobility behavior, traditional analytical models have not been suitable for the propagation dynamics of social worms nowadays, which results in underestimating the scale of infected network and lacking a comprehensive and accurate abstraction for human behaviors. This letter proposes a novel model to understand the propagation dynamics of social worms in hierarchical networks based on the temporal characteristic of human mobility. We characterize the infection scale and the spread speed for social worms adopting discrete model and difference-equation method. Our simulations and analysis show our model to approximate the complicated propagation behaviors of social worms more accurately, and we give two quantitative conclusions on the range of final infection scale and the fastest spread speed. In addition, the results indicate the rationality and validity of our conclusions.

An immunization strategy for social network worms based on network vertex influence

Along with the rapid development of social networks, social network worms have constituted one of the major internet security problems. The root of worm is the inevitable software vulnerability during the design and implementation process of software. So it is hard to completely avoid worms in the existing software engineering systems. Due to lots of bandwidth consumption, the patch cannot be transmitted simultaneously by the network administrator to all hosts. This paper studies how to prevent the propagation of social network worms through the immunization of key nodes. Unlike existing containment models for worm propagation, a novel immunization strategy is proposed based on network vertex influence. The strategy selects the critical vertices in the whole network. Then the immunization is applied on the selected vertices to achieve the maximal effect of worm containment with minimal cost. Different algorithms are implemented to select vertices. Simulation experiments are presented to analyze and evaluate the performance of different algorithms.

Hybrid epidemics--a case study on computer worm conficker.

Conficker is a computer worm that erupted on the Internet in 2008. It is unique in combining three different spreading strategies: local probing, neighbourhood probing, and global probing. We propose a mathematical model that combines three modes of spreading: local, neighbourhood, and global, to capture the worm’s spreading behaviour. The parameters of the model are inferred directly from network data obtained during the first day of the Conficker epidemic. The model is then used to explore the tradeoff between spreading modes in determining the worm’s effectiveness. Our results show that the Conficker epidemic is an example of a critically hybrid epidemic, in which the different modes of spreading in isolation do not lead to successful epidemics. Such hybrid spreading strategies may be used beneficially to provide the most effective strategies for promulgating information across a large population. When used maliciously, however, they can present a dangerous challenge to current internet security protocols.

Hybrid spreading mechanisms and T cell activation shape the dynamics of HIV-1 infection.

HIV-1 can disseminate between susceptible cells by two mechanisms: cell-free infection following fluid-phase diffusion of virions and by highly-efficient direct cell-to-cell transmission at immune cell contacts. The contribution of this hybrid spreading mechanism, which is also a characteristic of some important computer worm outbreaks, to HIV-1 progression in vivo remains unknown. Here we present a new mathematical model that explicitly incorporates the ability of HIV-1 to use hybrid spreading mechanisms and evaluate the consequences for HIV-1 pathogenenesis. The model captures the major phases of the HIV-1 infection course of a cohort of treatment naive patients and also accurately predicts the results of the Short Pulse Anti-Retroviral Therapy at Seroconversion (SPARTAC) trial. Using this model we find that hybrid spreading is critical to seed and establish infection, and that cell-to-cell spread and increased CD4+ T cell activation are important for HIV-1 progression. Notably, the model predicts that cell-to-cell spread becomes increasingly effective as infection progresses and thus may present a considerable treatment barrier. Deriving predictions of various treatments’ influence on HIV-1 progression highlights the importance of earlier intervention and suggests that treatments effectively targeting cell-to-cell HIV-1 spread can delay progression to AIDS. This study suggests that hybrid spreading is a fundamental feature of HIV infection, and provides the mathematical framework incorporating this feature with which to evaluate future therapeutic strategies.

Basic definitions for discrete modeling of computer worms epidemics

The information technologies have evolved in such a way that communication between computers or hosts has become common, so much that the worldwide organization (governments and corporations) depends on it; what could happen if these computers stop working for a long time is catastrophic. Unfortunately, networks are attacked by malware such as viruses and worms that could collapse the system. This has served as motivation for the formal study of computer worms and epidemics to develop strategies for prevention and protection; this is why in this paper, before analyzing epidemiological models, a set of formal definitions based on set theory and functions is proposed for describing 21 concepts used in the study of worms. These definitions provide a basis for future qualitative research on the behavior of computer worms, and quantitative for the study of their epidemiological models.

Game-Theoretic Methods for Robustness, Security, and Resilience of Cyberphysical Control Systems: Games-in-Games Principle for Optimal Cross-Layer Resilient Control Systems

Critical infrastructures, such as power grids and transportation systems, are increasingly using open networks for operation. The use of open networks poses many challenges for control systems. The classical design of control systems takes into account modeling uncertainties as well as physical disturbances, providing a multitude of control design methods such as robust control, adaptive control, and stochastic control. With the growing level of integration of control systems with new information technologies, modern control systems face uncertainties not only from the physical world but also from the cybercomponents of the system. The vulnerabilities of the software deployed in the new control system infrastructure will expose the control system to many potential risks and threats from attackers. Exploitation of these vulnerabilities can lead to severe damage as has been reported in various news outlets [1], [2]. More recently, it has been reported in [3] and [4] that a computer worm, Stuxnet, was spread to target Siemens supervisory control and data acquisition (SCADA) systems that are configured to control and monitor specific industrial processes.

Control-Theoretic Methods for Cyberphysical Security: Geometric Principles for Optimal Cross-Layer Resilient Control Systems

Cyberphysical systems integrate physical processes, computational resources, and communication capabilities. Cyberphysical systems have permeated modern society, becoming prevalent in many domains, including energy production, health care, and telecommunications. Examples of cyberphysical systems include sensor networks, industrial automation systems, and critical infrastructures such as transportation networks, power generation and distribution networks, water and gas distribution networks, and advanced manufacturing systems. The integration of cybertechnologies with physical processes increases system efficiencies and, at the same time, introduces vulnerabilities that undermine the reliability of critical infrastructures. As recently highlighted by the Maroochy water breach in March 2000 [1], multiple recent power blackouts in Brazil [2], the SQL Slammer worm attack on the Davis-Besse nuclear plant in January 2003 [3], the StuxNet computer worm in June 2010 [4], and various industrial security incidents [5], cyberphysical systems are prone to failures and attacks on their physical infrastructure and cyberattacks on their data management and communication layer [6], [7].

A Worm Defending Model with Partial Immunization and Its Stability Analysis

Internet worms, a great threat to the Internet infrastructure, can propagate horrendously through networks, and reduce network security and cause economic losses. In order to effectively defend against worms, this paper proposes a novel epidemic SVEIR model with partial immunization. In the SVEIR model, we obtain the basic reproduction number for determining whether the worm dies out completely. The global stabilities of infection-free equilibrium and endemic equilibrium are proven using a Lyapunov function and a geometrical approach. The impact of different parameters of this model is studied. Simulation results show that the number of susceptible and infected hosts is consistent with theoretical analysis. The model provides a theoretical foundation for control and forecasting Internet worms. Index Terms—Network security, Internet worm, stability analysis, endemic equilibrium, partial immunization

Effects of dynamic quarantine and nonlinear infection rate in a model for computer worms propagation.

We propose a new model for computer worms propagation, using dynamic quarantine and a nonlinear infection rate. The dynamic quarantine is based in epidemic disease control methods and in the principle ‘assume guilty before proven inocent’. This means that the host is blocked whenever its behavior looks suspicious. After a short time, the quarantined computer is released. The nonlinear infection rate is used to capture the dynamics of overcrowded infectious networks and high viral loads. We simulate numerically the model for distinct values of the quarantine times. We observe that increasing the quarantine time decreases the number of infectious hosts in the network.