Worm evolution tracking via timing analysis

WORM'05 - Proceedings of the 2005 ACM Workshop on Rapid Malcode

Volumn , Issue , 2005, Pages 52-59

  Rajab, Moheeb Abu ^a   Monrose, Fabian ^a   Terzis, Andreas ^a  

^a JOHNS HOPKINS UNIVERSITY   (United States)

Author keywords

Internet worms; Methods of attribution; Network security

Indexed keywords

INTERNET WORMS; METHOD OF ATTRIBUTION; NETWORK SECURITY;

INTERNET; PARAMETER ESTIMATION; RELIABILITY; SECURITY OF DATA; TELECOMMUNICATION TRAFFIC;

COMPUTER WORMS;

EID: 31844457315     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (24)

1. Michael Bailey, Evan Cooke, Farnam Jahanian, Jose Nazario, and David Watson. Internet motion sensor: A distributed blackhole monitoring system. In Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS), 2005.
2. CAIDA. http://www.caida.org.
3. CERT. CERT Advisory CA-2001-26 Nimda Worm. http:// www.cert.org/ advisories/ca-2001-26.html.
4. CERT. Code Red II: Another Worm Exploiting Buffer Overflow in IIS Indexing Service DLL. http://www.cert.org/ incident_notes/in-2001-09.html.
5. Zesheng Chen, Lixin Gao, and Kevin Kwiat. Modeling the Spread of Active Worms. In Proceedings of IEEE INFOCOMM, volume 3, pages 1890 - 1900, 2003.
6. H.W. Hethcote. The Mathematics of Infectious Diseases. In SIAM Reviews, Vol. 42 No. 4, 2000.
7. iSink- University of Wisconsin, http://wail.cs.wisc.edu/.
8. Abhishek Kumar, Vern Paxson, and Nicholas Weaver. Exploiting Underlying Structure for Detailed Reconstruction of an Internet-scale Event. In Technical Report.
9. th USENIX Security Symposium, Invited Talk, August 2002.
10. David Moore, Vern Paxson, Stefan Savage, Colleen Shannon, Stuart Staniford, and Nicholas Weaver. Inside the Slammer Worm. IEEE Magazine of Security and Privacy Magazine, pages 33-39, July 2003.
11. David Moore, Colleen Shannon, Geoffrey M. Voelker, and Stefan Savage. Internet Quarantine: Requirements for Containing Self-Propagating Code. In Proceedings of IEEE INFOCOM, 2003.
12. David Moore, Collen Shannon, and Jeffry Brown. Code-Red: A case study on the spread and victims of an Internet worm. In Proceedings of Internet Measurement Workshop, pages 273-284, November 2002.
13. th USENIX Security Symposium, August 2001.
14. th USENIX Security Symposium, pages 225-237, August 2005.
15. Colleen Shannon and David Moore. The Spread of the Witty Worm. IEEE Security and Privacy Magazine, 2(4):46-50, July 2004.
16. Stuart Staniford. Containment of Scanning Worms in Enterprose Networks. In Journal of Computer Security, 2004.
17. th USENIX Security Symposium, August 2002.
18. Jamie Twycross and Matthew M. Williamson. Implementing and Testing a Virus Throttle. In Proceedings of the 12th USENIX Security Symposium, August 2003.
19. Nicholas Weaver, Vern Paxson, Stuart Staniford, and R. Cunningham. A taxonomy of computer worms. In Proceedings of the First ACM Workshop on Rapid Malcode (WORM), 2003.
20. Nicholas Weaver, Stuart Staniford, and Vern Paxson. Very Fast Containment of Scanning Worms. In Proceedings of the 13th USENIX Security Symposium, August 2004.
21. Matthew M. Williamson. Throttling Viruses: Restricting Propagation to Defeat Malicious Mobile Code. In Proceedings of the 18th Annual Computer Security Conference, pages 61-68, December 2002.
22. The CAIDA Dataset on the Witty Worm - March 19-24, 2004, Colleen Shannon and David Moore, http://www.caida.org/ passive/witty/. Support for the Witty Worm dataset and the UCSD Network Telescope are provided by Cisco Systems, Limelight Networks, DHS, NSF, CAIDA, DARPA, Digital Envoy, and CAIDA Members.
23. Yinglian Xie, Vyas Sckar, David A. Maltz, Michael K. Reiter, and Hui Zhang. Worm Origin Identification Using Random Moonwalks. In Proceedings of IEEE Symposium on Security and Privacy, pages 242-256, May 2005.
24. Cliff Zou, Weibo Gong, and Don Towsley. Code Red Worm Propagation Modeling and Analysis. In Proceedings of ACM Conference on Computer and Communication Security (CCS), pages 138-147, 2002.