Online Tracing Scanning Worm with Sliding Window

As many people rely on e-mail communications for business and everyday life, Internet e-mail worms constitute one of the major security threats for our society. Unlike scanning worms such as Code Red or Slammer, e-mail worms spread over a logical network defined by e-mail address relationships, making traditional epidemic models invalid for modeling the propagation of e-mail worms. In addition, we show that the topological epidemic models presented by M. Boguna, et al. (2000) largely overestimate epidemic spreading speed in topological networks due to their implicit homogeneous mixing assumption. For this reason, we rely on simulations to study e-mail worm propagation in this paper. We present an e-mail worm simulation model that accounts for the behaviors of e-mail users, including e-mail checking time and the probability of opening an e-mail attachment. Our observations of e-mail lists suggest that an Internet e-mail network follows a heavy-tailed distribution in terms of node degrees, and we model it as a power-law network. To study the topological impact, we compare e-mail worm propagation on power-law topology with worm propagation on two other topologies: small-world topology and random-graph topology. The impact of the power-law topology on the spread of e-mail worms is mixed: E-mail worms spread more quickly on a power-law topology than on a small-world topology or a random-graph topology, but immunization defense is more effective on a power-law topology.

This article discusses modeling and detection properties associated with the stochastic behavior of Random Constant Scanning (RCS) worms. Although these worms propagate by randomly scanning network addresses to find hosts that are susceptible to infection, traditional RCS worm models are fundamentally deterministic. A density-dependent Markov jump process model for RCS worms is presented and analyzed herein. Conditions are shown for when some stochastic properties of RCS worm propagation can be ignored and when deterministic RCS worm models can be used. A computationally simple hybrid deterministic/stochastic point-process model for locally observed scanning behavior due to the global propagation of an RCS scanning worm epidemic is presented. An optimal hypothesis-testing approach is presented to detect epidemics of these under idealized conditions based on the cumulative sums of log-likelihood ratios using the hybrid RCS worm model. This article presents in a mathematically rigorous fashion why detection techniques that are only based on passively monitoring local IP addresses cannot quickly detect the global propagation of an RCS worm epidemic with a low false alarm rate, even under idealized conditions.

인터넷 웜은 컴퓨터 네트워크를 이용하여 자기 자신을 자동으로 복제해서 전파하는 프로그램이다. 컴퓨터간의 네트워크 연결이 증가함에 따라 인터넷 웜은 급격해 확산되었고 큰 위협으로 남아있다. 코드 레드, 님다, 슬레머 같은 인터넷 웜의 특성과 이들의 활동을 억제하는 방법을 찾기 위해서 웜이 전파되는 특성을 연구하려는 많은 시도가 있었다. 네트워크 특징들이 인터넷 웜 전파에 미치는 영향은 모델의 간단성과 유사성 때문에 주로 의학계에서 사용되는 전염병 전파 모델을 이용하여 모델링이 되었다. 이런 의학계 모델링은 널리 사용되면서 여러 개선된 모델들이 다양하게 제안되었다. 우리는 이전의 제안된 모델들의 문제점을 분석한 후 통계적 방법을 사용하여 정확도를 높이는 새로운 방법의 웜 전파 모델링을 제안한다. An Internet worm is a self-replicating malware program which uses a computer network. As the network connectivity among computers increases, Internet worms have become widespread and are still big threats. There are many approaches to model the propagation of Internet worms such as Code Red, Nimda, and Slammer to get the insight of their behaviors and to devise possible defense methods to suppress worms' propagation activities. The influence of the network characteristics on the worm propagation has usually been modeled by medical epidemic model, named SI model, due to its simplicity and the similarity of propagation patterns. So far, SI model is still dominant and new variations of the SI model, called SI-style models, are being proposed for the modeling of new Internet worms. In this paper, we elaborate the problems of SI-style models and then propose a new accurate stochastic model using an occupancy problem.

Hopf bifurcation in an Internet worm propagation model with time delay in quarantine

The popularity of wireless communication networks makes them an attractive target to the creators of worms and other malicious code. Indeed, recently a number of worms designed specifically to spread via these wireless networks have emerged. Based on the epidemic theory, this paper proposes a general model which predicts how a worm propagates through a wireless ad hoc network. Then the differential equations of the model is presented and a necessary condition for worms to spread in these networks is derived, which may be useful in designing a secure wireless ad hoc network. Simulation results show that the process of worm propagation in these wireless networks is sensitive to the deployment density of nodes and the energy consumption of nodes. Therefore, our study can provide insight into deriving a general model to characterize worm propagation in wireless ad hoc networks.

Software simulation is one of the most common methods to study worm propagation. However, simulation process and software interface, which lack unified description, cause inefficiencies of worm propagation simulation. In order to achieve a unified description for worm propagation simulation process, we propose a Worm Propagation Simulation Description Language (WPSDL), which characterizes the software interfaces and parameters of each module in simulation process in a unified way. Meanwhile, we develop a simulation system of worm propagation oriented our presented language. In this system, we use related commands of the description language as interactive instructions, and then implement worm propagation simulation for different types of network worms. In addition, we conduct a series of experiments to analyse the impacts of worm propagation mechanism and network topology structure. The experiments show that increasing infection ability and scanning rate can improve the propagation scale significantly, and the propagation delay can influence the outbreak time and explosion intensity of worm propagation. The experiments not only provide support for the study of worm propagation mechanisms, but also verify the practicability of the description language and the simulation system.

A computer worm is malicious software that can spread rapidly between interconnected devices and perform malicious actions. In an Advanced Metering Infrastructure (AMI), smart meters may communicate in an ad-hoc fashion to perform many functionalities like remote metering and demand response. However, the AMI is susceptible to cyber-physical threats caused by malware like worms. The speed at which worms propagate in the AMI affects the physical consequences of cyber attacks. In this paper, worm propagation in the AMI is simulated and a probabilistic model is derived. This model can be used to estimate the time required to infect N meters in the AMI and accordingly predict possible physical consequences.

On the performance of Internet worm scanning strategies

Propagation of Internet worms is a serious problem in our highly information oriented society. In this paper, we propose a stochastic model for Internet worm propagation to evaluate its dependability measures quantitatively. More precisely, the deterministic kill-signal model is reformulated based on a continuous-time Markov chain. We define some dependability measures and derive the recursive computation algorithms to assess them. In numerical experiments, we investigate the behavior of actual Internet worms with real infection data and characterize their propagation

In less than two decades, computer viruses and worms have grown from an anomaly to an everyday occurrence. In response to such a threat, the academic community has started a set of research projects seeking to understand worm behavior through creation of models. Staniford created a model to explain the propagation behaviors of worms in computer network environments. Liljenstam added a spatial perspective to this model, varying the infection rate by the scanning worms' source and destination groups. These models have been shown to describe generic Internet-scale behavior adequately. However, they often ignore the nuances present on a highly localized network such as a campus-at a local university. In this manuscript, we make and validate the claim that certain real-world constraints, such as bandwidth and heterogeneity of hosts, affect the propagation of worms and thus should not be ignored when creating models for analysis of worm behaviors.

The dynamics of worm propagation in the Wireless Sensor Networks (WSNs) is one of the fundamental challenge due to critical operational constraints. In this paper we propose a modified Susceptible-Infectious-Quarantined-Recovered-Susceptible (SIQRS) model based on epidemic theory. The proposed model demonstrate the effect of quarantined state on worms propagation in WSNs. This model incorporates communication radius, area of communication and the associated node density. The spreading dynamics of worms defined with the help of Basic Reproduction Number (R0) and if R0 is less than or equal to one the worm-free equilibrium is globally asymptotically stable, and if R0 is greater than one the worm will persists in the system. This model formulated by differential equations and explain the process of worm propagation in WSNs. We also study the effect of different parameters on the performance of system. Finally, the control mechanism and performance of the proposed model is validated through extensive simulation results.

Bluetooth networks are envisioned to provide many promising services and applications. Meanwhile, Bluetooth networks are also increasingly becoming the target of worms. Many emerging worms can utilize the proximity of devices to propagate in a distributed manner, resulting in modeling on worm propagation substantially more challenging. In this paper, we propose an efficient Worm Propagation Modeling scheme, WPM for short. WPM utilizes the two-dimensional (2D) cellular automata to simulate the dynamics of the worm propagation process from a single node to the entire Bluetooth network. The WPM scheme integrates infection factor, which evaluates the spread degree of infected nodes, and resistance factor, which offers resistance evaluation towards susceptible nodes. Moreover, the epidemic state of each node is classified into five types in the WPM scheme, including susceptible, exposed, infected, diagnosed, and recovered. The effectiveness and rationality of the proposed model are validated through extensive simulations.

To quickly and efficiently recognize abnormal patterns from large-scale time series and pathological signals in epilepsy, this paper presents here a preliminary RSW&TST framework for Multiple Change-Points (MCPs) detection based on the Random Slide Window (RSW) and Trigeminal Search Tree (TST) methods. To avoid the remaining local optima, the proposed framework applies a random strategy for selecting the size of each slide window from a predefined collection, in terms of data feature and experimental knowledge. For each data segment to be diagnosed in a current slide window, an optimal path towards a potential change point is detected by TST methods from the top root to leaf nodes with O(log3(N)). Then, the resulting MCPs vector is assembled by means of TST-based single CP detection on data segments within each of the slide windows. In our experiments, the RSW&TST framework was tested by using large-scale synthetic time series, and then its performance was evaluated by comparing it with existing binary search tree (BST), Kolmogorov-Smirnov (KS)-statistics, and T-test under the fixed slide window (FSW) approach, as well as the integrated method of wild binary segmentation and CUSUM test (WBS&CUSUM). The simulation results indicate that our RSW&TST is both more efficient and effective, with a higher hit rate, shorter computing time, and lower missed, error and redundancy rates. When the proposed RSW&TST framework is executed for MCPs detection on pathological ECG (electrocardiogram)/EEG (electroencephalogram) recordings of people in epileptic states, the abnormal patterns are roughly recognized in terms of the number and position of the resultant MCPs. Furthermore, the severity of epilepsy is roughly analyzed based on the strength and period of signal fluctuations among multiple change points in the stage of a sudden epileptic attack. The purpose of our RSW&TST framework is to provide an encouraging platform for abnormal pattern recognition through MCPs detection on large-scale time series quickly and efficiently.

Peer-to-Peer (P2P) worms have become a serious problem on the Internet because of its adaptive propagation features. Due to the complexity of the problem, no existing work has solved the problem of modeling the propagation of P2P worms, especially when quarantine of peers is enforced. This paper presents a study on modeling the propagation of P2P worms under quarantine. We strive to find a quarantine tactic which is able to protect the majority of the peers by quarantining only the minority of them. Our major contributions in this paper are firstly, we propose a novel logic matrix approach to modeling the propagation of P2P worms; and secondly, we find the impacts of the two different quarantine tactics on the propagation characteristics of P2P worms. Motivated by our aspiration to invent an easy-to-employ instrument for worm propagation research, the proposed approach models the propagation processes of P2P worms by difference equations of logic matrix, which are essentially discrete-time deterministic propagation models of P2P worms. To the best of our knowledge, we are the first using logic matrix in network security research in general and worm propagation modeling in particular.

With rapid development of Internet, network security issues become increasingly serious. Temporary patches have been put on the infectious hosts, which may lose efficacy on occasions. This leads to a time delay when vaccinated hosts change to susceptible hosts. On the other hand, the worm infection is usually a nonlinear process. Considering the actual situation, a variable infection rate is introduced to describe the spread process of worms. According to above aspects, we propose a time-delayed worm propagation model with variable infection rate. Then the existence condition and the stability of the positive equilibrium are derived. Due to the existence of time delay, the worm propagation system may be unstable and out of control. Moreover, the threshold τ0 of Hopf bifurcation is obtained. The worm propagation system is stable if time delay is less than τ0. When time delay is over τ0, the system will be unstable. In addition, numerical experiments have been performed, which can match the conclusions we deduce. The numerical experiments also show that there exists a threshold in the parameter a, which implies that we should choose appropriate infection rate β(t) to constrain worm prevalence. Finally, simulation experiments are carried out to prove the validity of our conclusions.