Accelerating the Propagation of Active Worms by Employing Multiple Target Discovery Techniques

Today, the propagation of active worms in peer-to-peer (P2P) networks is a very serious issue. Therefore, studying the propagation behavior of active worms and modeling their proliferation is quite useful to employ an effective and low-cost defense strategy to reduce the rate of their propagation. The topology-aware worms use the information related to the topology and the network structure of their victims to propagate in the network. Recently, the logic matrix has been utilized to model the effect of worm propagation. In this paper, we use this kind of matrices to model the propagation of topology-aware active worms with emphasis on the impacts of the join and leave of hosts on the propagation ratio. Using a simulation model, we have studied and compared the impacts of the join and leave of hosts with the situations without them. The simulation results show the considerable impacts of join and leave on the propagation of worms.

Modeling and analysis of Internet worm propagation

The propagation of P2P worm covers large area and causes great damage. A dynamic quarantine protocol is designed to quarantine the suspicious host in the P2P system. Then a mathematical model of PWPQ is proposed which considering the dynamic process of peer joining and leaving. The effect of dynamic quarantine on active P2P worm is analyzed. Through stability analysis for PWPQ model, a key argument of infection-free stable point which affect the P2P worm propagation, the basic reproduction number, is deduced. Simulation results show that the propagation model of P2P worms can reflect the P2P worm behaviors and the performance of our model is significantly better than other models, in terms of decreasing the number of infected hosts and reducing the worm propagation speed. When the basic reproduction number is less than 1, infection-free stable point is global stability and the P2P worm are eliminated. The PWPQ model gives some way to control P2P worm break out and gives guidelines to P2P worm detection and defense.

Peer-to-Peer (P2P) worms have become a serious problem on the Internet because of its adaptive propagation features. Due to the complexity of the problem, no existing work has solved the problem of modeling the propagation of P2P worms, especially when quarantine of peers is enforced. This paper presents a study on modeling the propagation of P2P worms under quarantine. We strive to find a quarantine tactic which is able to protect the majority of the peers by quarantining only the minority of them. Our major contributions in this paper are firstly, we propose a novel logic matrix approach to modeling the propagation of P2P worms; and secondly, we find the impacts of the two different quarantine tactics on the propagation characteristics of P2P worms. Motivated by our aspiration to invent an easy-to-employ instrument for worm propagation research, the proposed approach models the propagation processes of P2P worms by difference equations of logic matrix, which are essentially discrete-time deterministic propagation models of P2P worms. To the best of our knowledge, we are the first using logic matrix in network security research in general and worm propagation modeling in particular.

Hopf bifurcation in an Internet worm propagation model with time delay in quarantine

Peer-to-peer (P2P) networking technology has gained popularity as an efficient mechanism for users to obtain free services without the need for centralized servers. Protecting these networks from intruders and attackers is a real challenge. One of the constant threats on P2P networks is the propagation of active worms. Recent events show that active worms can spread automatically and flood the Internet in a very short period of time. Therefore, P2P systems can be a potential vehicle for active worms to achieve fast worm propagation in the Internet. Nowadays, BitTorrent is becoming more and more popular, mainly due its fair load distribution mechanism. Unfortunately, BitTorrent is particularly vulnerable to topology aware active worms. In this paper we analyze the impact of a new worm propagation threat on BitTorrent. We identify the BitTorrent vulnerabilities it exploits, the characteristics that accelerate and decelerate its propagation, and develop a mathematical model of their propagation. We also provide numerical analysis results. This will help the design of efficient detection and containment systems.

Passive worms pose threats to mobile P2P(peer-to-peer) networks. To predict the tendency of propagation of mobile P2P passive worms and analyze their behaviors, it is necessary to model mobile P2P passive worm propagation. In this paper, the protocols of mobile P2P networks and the features of passive worm propagation are studied. On the basis, the mathematical model of passive worm propagation is proposed in applying Epidemiology. For the purpose of examining the effect of the mobile P2P-related parameters on worm propagation, simulation experiments are carried out. The results of these experiments show that different parameters have different effect on passive worm propagation, among which the average downloading rate and the average recovery rate of fixed peers have the strongest effect on passive worm propagation among mobile peers.

The problem of network worms is worsening despite increasing efforts and expenditure on cyber-security. Worm propagation is a random process that creates a complex system of interacting agents (worm copies) over the propagation medium – a scale-free graph, representing real-world networks. Understanding the propagation of network worms on scale-free graphs is the first step towards devising effective techniques for worm quarantining. After presenting the drawbacks of existing mean-field models, we develop a pair-approximation (correlation) model of worm propagation that employs the salient network characteristics – order, size, degree distribution, and transitivity. Inclusion of the transitivity shows significant improvement over existing pair-approximation models. The validity of the model is confirmed by comparing the numeric solution of the model to results from our individual-based simulation. Our model demonstrates that the network structure has considerable impact on the propagation dynamics when the worm uses local propagation strategies.

Modeling and analyzing the spread of active worms based on P2P systems

This paper presents a study on modeling the propagation process of topology-aware worms. Topology-aware worms are more intelligent and adaptive to network topologies than other worms, thus are more difficult to control. Due to the complexity of the problem, no existing work has solved the problem of modeling the propagation of topology-aware worms. Our major contributions in this paper are firstly, we propose an innovative logic matrix formulation of the propagation process of topology-aware worms; and secondly, we find, from the applications of the formulation in our experiments, the impacts of two different topologies, namely the simple random graph topology and the pseudo power law topology, on a P2P worm's mean coverage rate in the P2P overlay network. The proposed innovative logic matrix formulation, which is a discrete time deterministic propagation model of topology-aware worms, can translate the propagation process of topology-aware worms into a sequence of logic matrix operations. Its effectiveness and efficiency are demonstrated by its applications in our experiments.

With rapid development of Internet, network security issues become increasingly serious. Temporary patches have been put on the infectious hosts, which may lose efficacy on occasions. This leads to a time delay when vaccinated hosts change to susceptible hosts. On the other hand, the worm infection is usually a nonlinear process. Considering the actual situation, a variable infection rate is introduced to describe the spread process of worms. According to above aspects, we propose a time-delayed worm propagation model with variable infection rate. Then the existence condition and the stability of the positive equilibrium are derived. Due to the existence of time delay, the worm propagation system may be unstable and out of control. Moreover, the threshold τ0 of Hopf bifurcation is obtained. The worm propagation system is stable if time delay is less than τ0. When time delay is over τ0, the system will be unstable. In addition, numerical experiments have been performed, which can match the conclusions we deduce. The numerical experiments also show that there exists a threshold in the parameter a, which implies that we should choose appropriate infection rate β(t) to constrain worm prevalence. Finally, simulation experiments are carried out to prove the validity of our conclusions.

Propagation of Internet worms is a serious problem in our highly information oriented society. In this paper, we propose a stochastic model for Internet worm propagation to evaluate its dependability measures quantitatively. More precisely, the deterministic kill-signal model is reformulated based on a continuous-time Markov chain. We define some dependability measures and derive the recursive computation algorithms to assess them. In numerical experiments, we investigate the behavior of actual Internet worms with real infection data and characterize their propagation

The popularity of wireless communication networks makes them an attractive target to the creators of worms and other malicious code. Indeed, recently a number of worms designed specifically to spread via these wireless networks have emerged. Based on the epidemic theory, this paper proposes a general model which predicts how a worm propagates through a wireless ad hoc network. Then the differential equations of the model is presented and a necessary condition for worms to spread in these networks is derived, which may be useful in designing a secure wireless ad hoc network. Simulation results show that the process of worm propagation in these wireless networks is sensitive to the deployment density of nodes and the energy consumption of nodes. Therefore, our study can provide insight into deriving a general model to characterize worm propagation in wireless ad hoc networks.

Software simulation is one of the most common methods to study worm propagation. However, simulation process and software interface, which lack unified description, cause inefficiencies of worm propagation simulation. In order to achieve a unified description for worm propagation simulation process, we propose a Worm Propagation Simulation Description Language (WPSDL), which characterizes the software interfaces and parameters of each module in simulation process in a unified way. Meanwhile, we develop a simulation system of worm propagation oriented our presented language. In this system, we use related commands of the description language as interactive instructions, and then implement worm propagation simulation for different types of network worms. In addition, we conduct a series of experiments to analyse the impacts of worm propagation mechanism and network topology structure. The experiments show that increasing infection ability and scanning rate can improve the propagation scale significantly, and the propagation delay can influence the outbreak time and explosion intensity of worm propagation. The experiments not only provide support for the study of worm propagation mechanisms, but also verify the practicability of the description language and the simulation system.

Bluetooth networks are envisioned to provide many promising services and applications. Meanwhile, Bluetooth networks are also increasingly becoming the target of worms. Many emerging worms can utilize the proximity of devices to propagate in a distributed manner, resulting in modeling on worm propagation substantially more challenging. In this paper, we propose an efficient Worm Propagation Modeling scheme, WPM for short. WPM utilizes the two-dimensional (2D) cellular automata to simulate the dynamics of the worm propagation process from a single node to the entire Bluetooth network. The WPM scheme integrates infection factor, which evaluates the spread degree of infected nodes, and resistance factor, which offers resistance evaluation towards susceptible nodes. Moreover, the epidemic state of each node is classified into five types in the WPM scheme, including susceptible, exposed, infected, diagnosed, and recovered. The effectiveness and rationality of the proposed model are validated through extensive simulations.