Overcoming the limitations in computer worm models

This article discusses modeling and detection properties associated with the stochastic behavior of Random Constant Scanning (RCS) worms. Although these worms propagate by randomly scanning network addresses to find hosts that are susceptible to infection, traditional RCS worm models are fundamentally deterministic. A density-dependent Markov jump process model for RCS worms is presented and analyzed herein. Conditions are shown for when some stochastic properties of RCS worm propagation can be ignored and when deterministic RCS worm models can be used. A computationally simple hybrid deterministic/stochastic point-process model for locally observed scanning behavior due to the global propagation of an RCS scanning worm epidemic is presented. An optimal hypothesis-testing approach is presented to detect epidemics of these under idealized conditions based on the cumulative sums of log-likelihood ratios using the hybrid RCS worm model. This article presents in a mathematically rigorous fashion why detection techniques that are only based on passively monitoring local IP addresses cannot quickly detect the global propagation of an RCS worm epidemic with a low false alarm rate, even under idealized conditions.

This paper examines the general behaviour of stealthy worms. In particular, we focus on worms that are designed based on network awareness. We study the case where a worm, instead of aiming to spread as fast as possible and penetrate intrusion detection systems (IDS), aims to avoid IDS and spread with the minimum number of detections. We compare different scanning strategies for this worm, including different combinations of hitlist and random scanning, and how they affect the number of infections and the rate of detected infection attempts. We compare the network-aware worm's behavior to that of the Code Red II worm. Simulations show that scanning worms can generate many fewer detections using localized scanning while maintaining its capability to infect.

Breaking out of network worms brings a tremendous damage to the Internet. Launch the worm defense and response can improve anti-attack capability of networks. Tracing worm propagation process after its outbreak can reconstruct not only the earliest infected nodes but also the timing order of victims been infected. Based on the improvement of existing offline worm tracing algorithm, we can realize the near real-time tracing for the propagation process of scanning worm: Network traffic data are real-time collected by the detection points from different LANs, then separated into continuous-time detection sliding windows; in every time window, we repeatedly and randomly collect paths that contain worm scanning and infected flow rate, reconstruct path of worm propagation in the current detection window. Results accumulated in sequential detection sliding windows continues doing feedback amendment, real-time reflect the process of worm propagation. we establish a virtual experimental environment of worm propagation and tracing to evaluate the algorithm. Tracing network worm propagation from the initial attack can inhibit continuous spread of the worm, ensure that no more host is infected by the worm, and provide basis for the determination of worm attack origin.KeywordsWormPropagation pathOnline tracingDetection window

The speed with which Internet worms propagate, and their potential for carrying devastating payloads makes them a significant threat to the stability of the Internet. Current approaches for containing these worms are ineffective due to their completely local protection mechanisms - requiring complete deployment for global worm containment. This paper suggests an alternate approach wherein the containment mechanisms are moved within the network itself rather than at end-points. This internetwork-centric approach allows networks within the Internet to not only protect themselves, but also other networks that may not have the containment technology deployed. A novel reputation-based alerting mechanism is used to ensure fair and fast information sharing. The combination of the internetwork-centric containment and reputation-based alerting allows for the creation of an Internet-wide containment mechanism that provides greater protection against fast scanning worms than any previously proposed system, and at the same time providing unequaled resilience to false positives and malicious nodes

The main purpose of intrusion detection system (IDS) is to find out intrusions among normal audit data and this can be considered as a classification problem. This problem is brought about by the user datagram protocol (UDP) which is a connectionless protocol that means it does not require a formal handshake to get the data flowing and has no need for SYNs, ACKs, FINs flags, or any other handshaking. Worms also make use of UDP protocol to connect or scan with other hosts. In this research, UDP scanning worm detection (UDPSWD) was proposed to detect UDP worm scanning by checking the failure message connections. UDPSWD focuses on the internet control message protocol (ICMP) unreachable, ICMP time exceeded and UDP is not responded to. The results show that UDPSWD is faster in comparison to other techniques, with no false positive or negative alarm.

This paper presents design research and instruction into the use of constraint based digital and analogue modelling techniques and the development of associative parametric models to simulate highly differentiated fabricated form. One set of these design research projects were conceived as manual analogue generative processes for prototyping modularity and serial differentiation. Then through parametric design techniques, modular aggregations were design explored and developed in concert with material properties and constraints. Utilizing digital fabrication full-scale installations were designed, manufactured, and for site-specific configurations. A second set of projects provides an extension of the design instruction that includes the integration of performance criteria into these design objectives. The objectives of the research are to present benefits and limitations of the incorporation of parametric design, performance analysis, and prototyping techniques in comprehensive studio instruction. The paper discusses the resultant informed materialized difference and the impacts on achieving reinforced and hands on learning objectives.

Today, the propagation of active worms in peer-to-peer (P2P) networks is a very serious issue. Therefore, studying the propagation behavior of active worms and modeling their proliferation is quite useful to employ an effective and low-cost defense strategy to reduce the rate of their propagation. The topology-aware worms use the information related to the topology and the network structure of their victims to propagate in the network. Recently, the logic matrix has been utilized to model the effect of worm propagation. In this paper, we use this kind of matrices to model the propagation of topology-aware active worms with emphasis on the impacts of the join and leave of hosts on the propagation ratio. Using a simulation model, we have studied and compared the impacts of the join and leave of hosts with the situations without them. The simulation results show the considerable impacts of join and leave on the propagation of worms.

The goal of this case-series was to increase our understanding of some complex within and between-host infection dynamics through the creation of mathematical and computational models that are able to capture the existing host and/or parasite heterogeneity. This goal was reached through a series of research projects (regarding experimental autoimmune encephalomyelitis (EAE) in mice, Mycobacterium avium subspecies paratuberculosis infection in cattle, Eimeria acervulina infection in chicken and human malaria) that gradually build up in complexity of both the system modelled and the modelling techniques used. In this case-series, the vast majority of model components have a direct link with reality. The results have shown some detailed examples of the valuable contribution that models have in understanding infection processes. The most satisfying achievements have come from those models that were able to, in hindsight, make complicated experimental results seem obvious and logical, and where the process of building the model was as insightful as the final results. The models created in these projects help to explain a wide range of sometimes contradictory experimental results and are used to predict the effect of control measures. In addition, they generate ideas for the development of new methods of control.

ly, a port specifies the endpoint of a connection on a networked device. Ports are identified as numbers. Many port numbers are standardized14 and denote a specific network or application protocol (e.g. port number 80 for HTTP or 23 for Telnet). A lot of the software components serving the respective protocols contain well-known and well-documented vulnerabilities or weaknesses (for instance, a system with anonymous login enabled). Thus, it is only a matter of finding computers that make use of those vulnerable protocols in order to try and attack the affected systems. This search can be automated using a number of tools. One famous example is SATAN (Security Administrator Tool for Analyzing Networks). SATAN is downloadable at no charge and comes with an easy-to-use HTML-based user interface. The tool automatically and efficiently scans any given host (or the respective subnet) for a number of known vulnerabilities and produces a clear and readable report. This report can then be used as a basis to look for actual vulnerabilities.15 2.3. How to Write a Computer Virus Computer viruses and worms are a common way of accessing computer systems without authorization. The effects differ: some viruses merely cause annoyance and inconvenience; others affect the functionality and stability of computing environments or compromise the confidentiality or integrity of (sometimes valuable) information. Three major aspects are important if someone wants to write their own computer virus: ● Payload. What does the virus do once it has infected a system? The amount of damage to be caused by the virus is arbitrary and can be freely specified by the author; ● Delivery and Propagation. How does the virus reach the target systems? And, in case of a (selfpropagating) worm, how does the worm automatically spread to other computer systems? ● Execution. How is the virus payload executed on the target machine? Computer viruses are not dangerous as long as they are not executed. There are two generic methods of ensuring that a virus is executed: (1) The virus can be programmed to exploit one of the countless vulnerabilities that exist in many of today’s mail clients or operating system components. Consequently, these types of viruses are executed without any form of user interaction; (2) Alternatively, the virus can rely on user interaction, in which case the virus is typically delivered as a simple e-mail attachment with a subject heading and content that invites people to open the attachment. The virus is executed as soon as the attachment is opened. Short Analysis of the ILOVEYOU Worm This section gives a short overview of the infamous ILOVEYOU worm by exploring each of the three aspects identified above. The goal is to give some insights into the internals of a virus (or worm) and show how easy it is to create this digital germ. ● Payload: The ILOVEYOU worm is written in Visual Basic Script, an easy-to-learn and powerful programming language by Microsoft, which is often used in (dynamic) web pages or e-mails. The complete payload of the ILOVEYOU worm serves the purpose of selfpropagation exclusively, and no further damage is done. Among other activities,16 the worm searches for certain types of files on the target machine and modifies those files depending on the type of file. It will, for instance, replace all occurrences of JPEG files (a commonly used image format) with a copy of itself and add the .vbs extension (denoting a Visual Basic Script file). If the user later tries to open one of the modified JPEG files, he or she will not see the image but rather (re-)activate the worm. The respective excerpt from the worm’s source code is given in Figure 2:17

With the appearance of a number of e-mail worms in recent years, we urgently need a solution to detect unknown e-mail worms rather than using the traditional solution: signature-based scanning which does not deal with the new e-mail worms well. Our collected data shows that the quantitative trend of e-mail worms is really exploding. In this paper, we propose an e-mail worm Detection System that is based on analysis on human and worm behavior for detecting unknown e-mail worms. Message data such as e-mail or short messages are the result of human behavior. The proposed system detects unknown worms by assessment of behavior in communication because human behavior and worm behavior have different projection on data.

Propagation of Internet worms is a serious problem in our highly information oriented society. In this paper, we propose a stochastic model for Internet worm propagation to evaluate its dependability measures quantitatively. More precisely, the deterministic kill-signal model is reformulated based on a continuous-time Markov chain. We define some dependability measures and derive the recursive computation algorithms to assess them. In numerical experiments, we investigate the behavior of actual Internet worms with real infection data and characterize their propagation

This paper attempts to predict new epidemics of computer threats based on statistical analysis and the detection of likeness through near-periodic functions. As main data, the authors use data on the growing number of Internet users, the increasing number of devices connected to the global network and data on computer viruses activity statistics over the years (detected epidemics of computer viruses activity, such as computer worm attacks, Trojan viruses, and other activities of this kind). Analysis of the data shows that the increasing of users number and various devices is well described by the model of limited growth of Gompertz with logistical dependence. Data analysis on computer viruses' epidemics shows the presence of trend and oscillatory components. To obtain accurate predictions of anticipated future epidemics of computer viruses, it is necessary to find a method which helps to divide the trend component and the oscillatory component without significantly losing information about the observed process. The work attempts to build such almost periodic functions and to compare simulated data with real-life data. Based on the processed data, the authors estimate the limit of the current growth in the number of Internet users in 5.4 billion users (while maintaining the current level of technology), as well as highlight the main almost-period lasting 7-9 years and the main almost-period at 16 years. The maximum appearance of next-generation malware can occur in 2020, which shows the existence of mechanisms for their functioning already at present time.)

This paper presents an automatic extraction approach of worm signatures based on behavioral footprint analysis. Firstly, the suspicious worm traffic is detected based on worm behavior and is an instance of the Sequential Change Point Detection. To make the detection mechanism insensitive to site and access pattern, a non-parametric Cumulative Sum (CUSUM) method is applied, thus making the detection mechanism much more generally applicable and its deployment much easier. Secondly, worm behavioral footprint is defined and classified. The chronicle formalism is applied to correlate the footprint in suspicious worm traffic. Finally, worm signatures are extracted and ascertained by the evaluation function. The experiment shows that the approach can extract worm signatures effectively and accurately. There is a conclusion that worm behavioral footprint can't identify the worm accurately, but it helps to locate worm signatures, so signatures can be extracted effectively.

This paper discusses the problem of automatically detecting the existence of Random Constant Scanning (RCS) worm epidemics on the Internet by observing packet traffic in a local network. The propagation of the RCS worm is modelled as a simple epidemic. An optimal hypothesis-testing approach is presented to detect simple epidemics under idealized conditions based on the cumulative sums of log-likelihood ratios. It is shown that there are limitations on the ability of this optimal method to detect several important subclasses of RCS worm epidemics even under idealized conditions.

In many species, individual social animals interact with others in their group and change their collective behaviours. For the solitary nematode Caenorhabditis elegans strain N2, previous research suggests that individuals can change the behaviour of other worms via pheromones and mechanosensory interactions. In particular, pheromones affect foraging behaviour, so that the chemotactic behaviours of individuals in a group (population) can be modulated by interactions with other individuals in the population. To investigate this, we directly compared the chemotactic behaviours of isolated (single) worms with those of individual animals within a population. We found that worms approached an odour source in a distinct manner depending on whether they were alone or in a population. Analysis of behaviours of the N2 worm and a pheromone production-defective mutant revealed that the 'pirouette' strategy was modulated by interaction of the worms via pheromones. Thus, pheromones play an important role in the characteristic collective behaviours seen in the population condition.