Self-adaptive worms and countermeasures

Authors:
Wei Yu;Nan Zhang;Wei Zhao
Affiliations:
Department of Computer Science, Texas A&M University, College Station, TX;Department of Computer Science and Engineering, University of Texas at Arlington, Arlington, TX;Department of Computer Science, Texas A&M University, College Station, TX
Venue:
SSS'06 Proceedings of the 8th international conference on Stabilization, safety, and security of distributed systems
Year:
2006

Citing 7
Cited 0

Digital Coding of Waveforms: Principles and Applications to Speech and Video

Digital Coding of Waveforms: Principles and Applications to Speech and Video
Code-Red: a case study on the spread and victims of an internet worm

Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
How to Own the Internet in Your Spare Time

Proceedings of the 11th USENIX Security Symposium
Monitoring and early warning for internet worms

Proceedings of the 10th ACM conference on Computer and communications security
Worm Origin Identification Using Random Moonwalks

SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Self-stopping worms

Proceedings of the 2005 ACM workshop on Rapid malcode
Autograph: toward automated, distributed worm signature detection

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this paper, we address issues related to defending against widespreading worms on the Internet. We study a new class of worms called the selfadaptive worms. These worms dynamically adapt their propagation patterns to defensive countermeasures, in order to avoid or postpone detection, and to eventually infect more computers. We show that existing worm detection schemes cannot effectively defend against these self-adaptive worms. To counteract these worms, we introduce a game-theoretic formulation to model the interaction between worm propagator and defender. We show that the effective integration of multiple defensive schemes (e.g., worm detection, forensics analysis) is critical for defending against self-adaptive worms. We propose different combinations of defensive schemes for different kinds of self-adaptive worms, and evaluate the performance of defensive schemes based on real-world traffic traces.