Deriving a closed-form expression for worm-scanning strategies

Authors:
Zesheng Chen;Chao Chen;Yubin Li
Affiliations:
Department of Electrical and Computer Engineering, Florida International University, Miami, FL 33174, USA.;Department of Engineering, Indiana University – Purdue University Fort Wayne, Fort Wayne, IN 46805, USA.;Department of Electrical and Computer Engineering, Florida International University, Miami, FL 33174, USA
Venue:
International Journal of Security and Networks
Year:
2009

Citing 13
Cited 4

Code-Red: a case study on the spread and victims of an internet worm

Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
How to Own the Internet in Your Spare Time

Proceedings of the 11th USENIX Security Symposium
A mean-field analysis of short lived interacting TCP flows

Proceedings of the joint international conference on Measurement and modeling of computer systems
The Spread of the Witty Worm

IEEE Security and Privacy
The monitoring and early detection of internet worms

IEEE/ACM Transactions on Networking (TON)
A self-learning worm using importance scanning

Proceedings of the 2005 ACM workshop on Rapid malcode
Advanced Routing Worm and Its Security Challenges

Simulation
On the performance of internet worm scanning strategies

Performance Evaluation
The impact of stochastic variance on worm propagation and detection

Proceedings of the 4th ACM workshop on Recurring malcode
On the effectiveness of distributed worm monitoring

SSYM'05 Proceedings of the 14th conference on USENIX Security Symposium - Volume 14
Optimal worm-scanning method using vulnerable-host distributions

International Journal of Security and Networks
On the race of worms, alerts, and patches

IEEE/ACM Transactions on Networking (TON)
Spatial-temporal modeling of malware propagation in networks

IEEE Transactions on Neural Networks

On the scalability of Delay-Tolerant Botnets

International Journal of Security and Networks
Wireless telemedicine and m-health: technologies, applications and research issues

International Journal of Sensor Networks
A survey of security visualization for computer network logs

Security and Communication Networks
A survey of cyber crimes

Security and Communication Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

This work presents a closed-form expression for characterising the spread of a class of worm-scanning strategies through a mean-field approximation. This expression can both accurately capture the worm propagation speed before the number of infections becomes large and explicitly demonstrate the effects of important parameters such as the vulnerable-host distribution and the worm-scanning strategy. Experimental results verify that the closed-form expression can accurately reflect the mean value of infections over time before the infected hosts become saturated for a wide range of scanning methods including static worm-scanning strategies and self-learning worms.