Worm Propagation Modeling Using 2D Cellular Automata in Bluetooth Networks

The popularity of wireless communication networks makes them an attractive target to the creators of worms and other malicious code. Indeed, recently a number of worms designed specifically to spread via these wireless networks have emerged. Based on the epidemic theory, this paper proposes a general model which predicts how a worm propagates through a wireless ad hoc network. Then the differential equations of the model is presented and a necessary condition for worms to spread in these networks is derived, which may be useful in designing a secure wireless ad hoc network. Simulation results show that the process of worm propagation in these wireless networks is sensitive to the deployment density of nodes and the energy consumption of nodes. Therefore, our study can provide insight into deriving a general model to characterize worm propagation in wireless ad hoc networks.

Hopf bifurcation in an Internet worm propagation model with time delay in quarantine

Peer-to-Peer (P2P) worms have become a serious problem on the Internet because of its adaptive propagation features. Due to the complexity of the problem, no existing work has solved the problem of modeling the propagation of P2P worms, especially when quarantine of peers is enforced. This paper presents a study on modeling the propagation of P2P worms under quarantine. We strive to find a quarantine tactic which is able to protect the majority of the peers by quarantining only the minority of them. Our major contributions in this paper are firstly, we propose a novel logic matrix approach to modeling the propagation of P2P worms; and secondly, we find the impacts of the two different quarantine tactics on the propagation characteristics of P2P worms. Motivated by our aspiration to invent an easy-to-employ instrument for worm propagation research, the proposed approach models the propagation processes of P2P worms by difference equations of logic matrix, which are essentially discrete-time deterministic propagation models of P2P worms. To the best of our knowledge, we are the first using logic matrix in network security research in general and worm propagation modeling in particular.

Breaking out of network worms brings a tremendous damage to the Internet. Launch the worm defense and response can improve anti-attack capability of networks. Tracing worm propagation process after its outbreak can reconstruct not only the earliest infected nodes but also the timing order of victims been infected. Based on the improvement of existing offline worm tracing algorithm, we can realize the near real-time tracing for the propagation process of scanning worm: Network traffic data are real-time collected by the detection points from different LANs, then separated into continuous-time detection sliding windows; in every time window, we repeatedly and randomly collect paths that contain worm scanning and infected flow rate, reconstruct path of worm propagation in the current detection window. Results accumulated in sequential detection sliding windows continues doing feedback amendment, real-time reflect the process of worm propagation. we establish a virtual experimental environment of worm propagation and tracing to evaluate the algorithm. Tracing network worm propagation from the initial attack can inhibit continuous spread of the worm, ensure that no more host is infected by the worm, and provide basis for the determination of worm attack origin.KeywordsWormPropagation pathOnline tracingDetection window

Recently, active worms have done significant damage due to their rapid propagation over the Internet. We studied propagation mechanisms of active worms employing single target discovery technique and various combinations of two or three different target discovery techniques from attackers’ perspective. We performed a series of simulation experiments to investigate their propagation characteristics under various scenarios. We found uniform scanning to be an indispensable elementary target discovery technique of active worms. Our major contributions in this paper are first, we proposed the discrete time deterministic Compensation Factor Adjusted Propagation (CFAP) model of active worms; and second, we suggested the combination of target discovery techniques that can best accelerate propagation of active worms discovered from results of the comprehensive simulations. The significance of this paper lies in it being very beneficial to understanding of propagation mechanisms of active worms, and thus building effective and efficient defense systems against their propagation.KeywordsNetwork SecurityInvasive SoftwareWormsPropagationModeling

The propagation of P2P worm covers large area and causes great damage. A dynamic quarantine protocol is designed to quarantine the suspicious host in the P2P system. Then a mathematical model of PWPQ is proposed which considering the dynamic process of peer joining and leaving. The effect of dynamic quarantine on active P2P worm is analyzed. Through stability analysis for PWPQ model, a key argument of infection-free stable point which affect the P2P worm propagation, the basic reproduction number, is deduced. Simulation results show that the propagation model of P2P worms can reflect the P2P worm behaviors and the performance of our model is significantly better than other models, in terms of decreasing the number of infected hosts and reducing the worm propagation speed. When the basic reproduction number is less than 1, infection-free stable point is global stability and the P2P worm are eliminated. The PWPQ model gives some way to control P2P worm break out and gives guidelines to P2P worm detection and defense.

The problem of network worms is worsening despite increasing efforts and expenditure on cyber-security. Worm propagation is a random process that creates a complex system of interacting agents (worm copies) over the propagation medium – a scale-free graph, representing real-world networks. Understanding the propagation of network worms on scale-free graphs is the first step towards devising effective techniques for worm quarantining. After presenting the drawbacks of existing mean-field models, we develop a pair-approximation (correlation) model of worm propagation that employs the salient network characteristics – order, size, degree distribution, and transitivity. Inclusion of the transitivity shows significant improvement over existing pair-approximation models. The validity of the model is confirmed by comparing the numeric solution of the model to results from our individual-based simulation. Our model demonstrates that the network structure has considerable impact on the propagation dynamics when the worm uses local propagation strategies.

Improving sensor network immunity under worm attacks: A software diversity approach

Modeling and analysis of Internet worm propagation

As many people rely on e-mail communications for business and everyday life, Internet e-mail worms constitute one of the major security threats for our society. Unlike scanning worms such as Code Red or Slammer, e-mail worms spread over a logical network defined by e-mail address relationships, making traditional epidemic models invalid for modeling the propagation of e-mail worms. In addition, we show that the topological epidemic models presented by M. Boguna, et al. (2000) largely overestimate epidemic spreading speed in topological networks due to their implicit homogeneous mixing assumption. For this reason, we rely on simulations to study e-mail worm propagation in this paper. We present an e-mail worm simulation model that accounts for the behaviors of e-mail users, including e-mail checking time and the probability of opening an e-mail attachment. Our observations of e-mail lists suggest that an Internet e-mail network follows a heavy-tailed distribution in terms of node degrees, and we model it as a power-law network. To study the topological impact, we compare e-mail worm propagation on power-law topology with worm propagation on two other topologies: small-world topology and random-graph topology. The impact of the power-law topology on the spread of e-mail worms is mixed: E-mail worms spread more quickly on a power-law topology than on a small-world topology or a random-graph topology, but immunization defense is more effective on a power-law topology.

In this paper, we model epidemic spreading by considering the mobility of nodes in complex dynamical network based on mean field theory using differential equations. Moreover, a resistance factor which can characterise the impact of individual's difference on the propagation dynamics in complex dynamical network is proposed by considering the influence of total number of connections and the continuous time to remain in contact. The effect of heterogeneity on the evolution process of propagation dynamics is explored by simulation. Extensive simulations are conducted to study the key influence parameters and the influence of them on the spreading dynamics, which are helpful to the understanding of epidemic spreading mechanism and the designing of effective control strategies.

Passive worms pose threats to mobile P2P(peer-to-peer) networks. To predict the tendency of propagation of mobile P2P passive worms and analyze their behaviors, it is necessary to model mobile P2P passive worm propagation. In this paper, the protocols of mobile P2P networks and the features of passive worm propagation are studied. On the basis, the mathematical model of passive worm propagation is proposed in applying Epidemiology. For the purpose of examining the effect of the mobile P2P-related parameters on worm propagation, simulation experiments are carried out. The results of these experiments show that different parameters have different effect on passive worm propagation, among which the average downloading rate and the average recovery rate of fixed peers have the strongest effect on passive worm propagation among mobile peers.

The dynamics of worm propagation in the Wireless Sensor Networks (WSNs) is one of the fundamental challenge due to critical operational constraints. In this paper we propose a modified Susceptible-Infectious-Quarantined-Recovered-Susceptible (SIQRS) model based on epidemic theory. The proposed model demonstrate the effect of quarantined state on worms propagation in WSNs. This model incorporates communication radius, area of communication and the associated node density. The spreading dynamics of worms defined with the help of Basic Reproduction Number (R0) and if R0 is less than or equal to one the worm-free equilibrium is globally asymptotically stable, and if R0 is greater than one the worm will persists in the system. This model formulated by differential equations and explain the process of worm propagation in WSNs. We also study the effect of different parameters on the performance of system. Finally, the control mechanism and performance of the proposed model is validated through extensive simulation results.

To improve mobile users' quality-of-experience (QoE) in the mobile cyber-physical system (MCPS), caching layered-coding contents on edge nodes that are close to mobile users has been advocated as a promising solution, which can efficiently lower the content delivery delay and mitigate the overhead of backhaul network. However, due to the complexity of trust management and the limited caching capacities of edge nodes, designing an efficient edge caching scheme for mobile users becomes a challenge. Meanwhile, the content caching in MCPS also faces some security problems, where edge nodes may return incorrect results or viruses to mobile users, and mobile users would deliberately refuse to pay for caching services. To tackle these problems, we propose a novel blockchain-based trustworthy edge caching scheme for mobile users in MCPS. Specifically, we first exploit blockchain to supervise the caching transactions between the edge nodes and mobile users in a distributed manner, whereby the caching service information cannot be modified and denied by any entities. Furthermore, we devise a trust management mechanism for mobile users to search the trustworthy caching services from diversified edge nodes, where the trust degree of the edge node is real-time evaluated and updated by mobile users based on the quality of caching service. To take full advantage of caching resources, we design a max-min-based resource allocation algorithm, with which the trustworthy edge node could fairly allocate its caching resource based on mobile users' optimal demands. The simulation results show that the presented scheme not only improves the utilities of edge nodes but also increases the QoE of mobile users.

Throughput is one of the most important factors in wireless communication. This paper studies the throughput efficiency of Bluetooth network using Enhanced Data Rate (EDR) packets. This paper, proposes improving the throughput efficiency of JPEG image transmission over mobile Bluetooth network using Enhanced Data Rate (EDR) packets. This paper uses the 2DH 3 and proposed 2DM 3 EDR Asynchronous Connectionless (ACL) packets. This paper presents a proposed using efficient error control schemes to improve the throughput of Bluetooth systems. A comparison study between different propositions is held in the paper to choose an efficient case over mobile Bluetooth network. The simulation experiments are carried over correlated Rayleigh fading channel. Our experiments reveal that the proposed convolutional code with constraint length K=3 and 7 improves the throughput efficiency of JPEG image at low SNR values. In our simulation results show that the convolutional codes are good over correlated fading channel more than the traditional Bluetooth error correction scheme for EDR Bluetooth packets. At higher SNR values (SNR>28dB) the standard uncoded 2DH3 packets gives a good throughput. Finally, using convolutional code with different K values improves the throughput over mobile Bluetooth network.