Modeling and analysis of Internet worm propagation

Although the frequency of Internet worm's outbreak is decreased, the impact of worm on people's wealth security and society's stabilization is still an unnegligible problem, especially the emergence of botnet. With the growth of variable network structure and applications, such as P2P network, Internet worms can explore more fast and covert ways to propagate. Hence, an accurate worm propagation model is urgently needed. In this paper, the concept and structure of worms are presented, then the typical propagation models in different environment are discussed, and the Advantages and Disadvantages of different models are given. It is our hope that others in the community who need to get up to speed in the worm literature can benefit from this survey.

The propagation of P2P worm covers large area and causes great damage. A dynamic quarantine protocol is designed to quarantine the suspicious host in the P2P system. Then a mathematical model of PWPQ is proposed which considering the dynamic process of peer joining and leaving. The effect of dynamic quarantine on active P2P worm is analyzed. Through stability analysis for PWPQ model, a key argument of infection-free stable point which affect the P2P worm propagation, the basic reproduction number, is deduced. Simulation results show that the propagation model of P2P worms can reflect the P2P worm behaviors and the performance of our model is significantly better than other models, in terms of decreasing the number of infected hosts and reducing the worm propagation speed. When the basic reproduction number is less than 1, infection-free stable point is global stability and the P2P worm are eliminated. The PWPQ model gives some way to control P2P worm break out and gives guidelines to P2P worm detection and defense.

Recently, active worms have done significant damage due to their rapid propagation over the Internet. We studied propagation mechanisms of active worms employing single target discovery technique and various combinations of two or three different target discovery techniques from attackers’ perspective. We performed a series of simulation experiments to investigate their propagation characteristics under various scenarios. We found uniform scanning to be an indispensable elementary target discovery technique of active worms. Our major contributions in this paper are first, we proposed the discrete time deterministic Compensation Factor Adjusted Propagation (CFAP) model of active worms; and second, we suggested the combination of target discovery techniques that can best accelerate propagation of active worms discovered from results of the comprehensive simulations. The significance of this paper lies in it being very beneficial to understanding of propagation mechanisms of active worms, and thus building effective and efficient defense systems against their propagation.KeywordsNetwork SecurityInvasive SoftwareWormsPropagationModeling

This paper presents a study on modeling the propagation process of topology-aware worms. Topology-aware worms are more intelligent and adaptive to network topologies than other worms, thus are more difficult to control. Due to the complexity of the problem, no existing work has solved the problem of modeling the propagation of topology-aware worms. Our major contributions in this paper are firstly, we propose an innovative logic matrix formulation of the propagation process of topology-aware worms; and secondly, we find, from the applications of the formulation in our experiments, the impacts of two different topologies, namely the simple random graph topology and the pseudo power law topology, on a P2P worm's mean coverage rate in the P2P overlay network. The proposed innovative logic matrix formulation, which is a discrete time deterministic propagation model of topology-aware worms, can translate the propagation process of topology-aware worms into a sequence of logic matrix operations. Its effectiveness and efficiency are demonstrated by its applications in our experiments.

Hopf bifurcation in an Internet worm propagation model with time delay in quarantine

Peer-to-Peer (P2P) worms have become a serious problem on the Internet because of its adaptive propagation features. Due to the complexity of the problem, no existing work has solved the problem of modeling the propagation of P2P worms, especially when quarantine of peers is enforced. This paper presents a study on modeling the propagation of P2P worms under quarantine. We strive to find a quarantine tactic which is able to protect the majority of the peers by quarantining only the minority of them. Our major contributions in this paper are firstly, we propose a novel logic matrix approach to modeling the propagation of P2P worms; and secondly, we find the impacts of the two different quarantine tactics on the propagation characteristics of P2P worms. Motivated by our aspiration to invent an easy-to-employ instrument for worm propagation research, the proposed approach models the propagation processes of P2P worms by difference equations of logic matrix, which are essentially discrete-time deterministic propagation models of P2P worms. To the best of our knowledge, we are the first using logic matrix in network security research in general and worm propagation modeling in particular.

The problem of network worms is worsening despite increasing efforts and expenditure on cyber-security. Worm propagation is a random process that creates a complex system of interacting agents (worm copies) over the propagation medium – a scale-free graph, representing real-world networks. Understanding the propagation of network worms on scale-free graphs is the first step towards devising effective techniques for worm quarantining. After presenting the drawbacks of existing mean-field models, we develop a pair-approximation (correlation) model of worm propagation that employs the salient network characteristics – order, size, degree distribution, and transitivity. Inclusion of the transitivity shows significant improvement over existing pair-approximation models. The validity of the model is confirmed by comparing the numeric solution of the model to results from our individual-based simulation. Our model demonstrates that the network structure has considerable impact on the propagation dynamics when the worm uses local propagation strategies.

With rapid development of Internet, network security issues become increasingly serious. Temporary patches have been put on the infectious hosts, which may lose efficacy on occasions. This leads to a time delay when vaccinated hosts change to susceptible hosts. On the other hand, the worm infection is usually a nonlinear process. Considering the actual situation, a variable infection rate is introduced to describe the spread process of worms. According to above aspects, we propose a time-delayed worm propagation model with variable infection rate. Then the existence condition and the stability of the positive equilibrium are derived. Due to the existence of time delay, the worm propagation system may be unstable and out of control. Moreover, the threshold τ0 of Hopf bifurcation is obtained. The worm propagation system is stable if time delay is less than τ0. When time delay is over τ0, the system will be unstable. In addition, numerical experiments have been performed, which can match the conclusions we deduce. The numerical experiments also show that there exists a threshold in the parameter a, which implies that we should choose appropriate infection rate β(t) to constrain worm prevalence. Finally, simulation experiments are carried out to prove the validity of our conclusions.

Computer viruses and worms spreading in the network depends on the proliferation of network structure. Network structure will affect the virus and worms' infection rate and scope of computer. This paper take the worm as the targeted, against the network transmission characteristics of real world, discusses the spread of computer viruses and control strategies of different network structures. Papers firstly make clearly what is the complex network and its features, and study what is network worms and the emergence of worms and its development process, understand the current status of the worm, studying focus on the spread of the worm models(simple transmission model, Kermack-Mckendrick Model, SIS model, two-factor model, BCM model-network worm confrontation model). Contact the characteristics of complex network and the worm's principle, make a little understanding of the worm detection and defense and the network-based control strategies of an important node. Give out effective proposals on the current developments in the worms, in addition to network worm suppression on each host, and by the entire network, we should comprehensivly using the important immune target and contain the virus as the virus control strategy. Strive to create a high reliability of the network.

Modeling and analyzing the spread of active worms based on P2P systems

Passive worms pose threats to mobile P2P(peer-to-peer) networks. To predict the tendency of propagation of mobile P2P passive worms and analyze their behaviors, it is necessary to model mobile P2P passive worm propagation. In this paper, the protocols of mobile P2P networks and the features of passive worm propagation are studied. On the basis, the mathematical model of passive worm propagation is proposed in applying Epidemiology. For the purpose of examining the effect of the mobile P2P-related parameters on worm propagation, simulation experiments are carried out. The results of these experiments show that different parameters have different effect on passive worm propagation, among which the average downloading rate and the average recovery rate of fixed peers have the strongest effect on passive worm propagation among mobile peers.

Propagation of Internet worms is a serious problem in our highly information oriented society. In this paper, we propose a stochastic model for Internet worm propagation to evaluate its dependability measures quantitatively. More precisely, the deterministic kill-signal model is reformulated based on a continuous-time Markov chain. We define some dependability measures and derive the recursive computation algorithms to assess them. In numerical experiments, we investigate the behavior of actual Internet worms with real infection data and characterize their propagation

The popularity of wireless communication networks makes them an attractive target to the creators of worms and other malicious code. Indeed, recently a number of worms designed specifically to spread via these wireless networks have emerged. Based on the epidemic theory, this paper proposes a general model which predicts how a worm propagates through a wireless ad hoc network. Then the differential equations of the model is presented and a necessary condition for worms to spread in these networks is derived, which may be useful in designing a secure wireless ad hoc network. Simulation results show that the process of worm propagation in these wireless networks is sensitive to the deployment density of nodes and the energy consumption of nodes. Therefore, our study can provide insight into deriving a general model to characterize worm propagation in wireless ad hoc networks.

As many people rely on e-mail communications for business and everyday life, Internet e-mail worms constitute one of the major security threats for our society. Unlike scanning worms such as Code Red or Slammer, e-mail worms spread over a logical network defined by e-mail address relationships, making traditional epidemic models invalid for modeling the propagation of e-mail worms. In addition, we show that the topological epidemic models presented by M. Boguna, et al. (2000) largely overestimate epidemic spreading speed in topological networks due to their implicit homogeneous mixing assumption. For this reason, we rely on simulations to study e-mail worm propagation in this paper. We present an e-mail worm simulation model that accounts for the behaviors of e-mail users, including e-mail checking time and the probability of opening an e-mail attachment. Our observations of e-mail lists suggest that an Internet e-mail network follows a heavy-tailed distribution in terms of node degrees, and we model it as a power-law network. To study the topological impact, we compare e-mail worm propagation on power-law topology with worm propagation on two other topologies: small-world topology and random-graph topology. The impact of the power-law topology on the spread of e-mail worms is mixed: E-mail worms spread more quickly on a power-law topology than on a small-world topology or a random-graph topology, but immunization defense is more effective on a power-law topology.

Wireless Sensor is one of the important communication device through which data can be collected and transmitted from any type of terrain. The collection of sensors constitutes a network that is a self-organized autonomous network which is called Wireless Sensor Network (WSN). A number of security challenges are addressed in WSN and one of the security issues is worms or virus attack. To study the attack and analysis of the spread and control of worms, the epidemic mathematical model becomes an important tool. We propose Susceptible (S), Infective (I), Treated (T), Highly infected (H), Recovered (R), SITHR model to describe the nonlinear dynamics of model. In this model, we propose that some infected individuals should move from treated phase to infected phase even after the use of a protection mechanism. The universal dynamics of the transmission of the worms can be analyzed by mathematical model and spreading behavior of a worm in WSN can be determined by the value R 0 basic reproduction number.