Inside the permutation-scanning worms: propagation modeling and analysis

Authors:
Parbati Kumar Manna;Shigang Chen;Sanjay Ranka
Affiliations:
Security Center of Excellence, Intel, Hillsboro, OR and Department of Computer and Information Science and Engineering, University of Florida, Gainesville, FL;Department of Computer and Information Science and Engineering, University of Florida, Gainesville, FL;Department of Computer and Information Science and Engineering, University of Florida, Gainesville, FL
Venue:
IEEE/ACM Transactions on Networking (TON)
Year:
2010

Citing 10
Cited 0

Code red worm propagation modeling and analysis

Proceedings of the 9th ACM conference on Computer and communications security
How to Own the Internet in Your Spare Time

Proceedings of the 11th USENIX Security Symposium
Inside the Slammer Worm

IEEE Security and Privacy
Slowing Down Internet Worms

ICDCS '04 Proceedings of the 24th International Conference on Distributed Computing Systems (ICDCS'04)
Preliminary results using scale-down to explore worm dynamics

Proceedings of the 2004 ACM workshop on Rapid malcode
Worm Detection, Early Warning and Response Based on Local Victim Information

ACSAC '04 Proceedings of the 20th Annual Computer Security Applications Conference
Self-stopping worms

Proceedings of the 2005 ACM workshop on Rapid malcode
Hamsa: Fast Signature Generation for Zero-day PolymorphicWorms with Provable Attack Resilience

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Modeling Propagation Dynamics of Bluetooth Worms

ICDCS '07 Proceedings of the 27th International Conference on Distributed Computing Systems
Optimal worm-scanning method using vulnerable-host distributions

International Journal of Security and Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

In recent years, both sophistication and damage potential of Internet worms have increased tremendously. To understand their threat, we need to look into their payload for signatures as well as propagation pattern for Internet-scale behavior. An accurate analytical propagation model allows us to comprehensively study how a worm propagates under various conditions, which is often computationally too intensive for simulations. More importantly, it gives us an insight into the impact of each worm/ network parameter on the propagation of the worm. Traditionally, most modeling work in this area concentrates on the relatively simple random-scanning worms. However, modeling the permutation-scanning worms, a class of worms that are fast yet stealthy, has been a challenge to date. This paper proposes a mathematical model that precisely characterizes the propagation patterns of the general permutation-scanning worms. The analytical framework captures the interactions among all infected hosts by a series of interdependent differential equations, which are then integrated into closed-form solutions that together present the overall worm behavior. We use the model to study how each worm/network parameter affects the worm propagation. We also investigate the impact of dynamic network conditions on the correctness of the model.