Hotspots: The root causes of non-uniformity in self-propagating malware

Proceedings of the International Conference on Dependable Systems and Networks

Volumn 2006, Issue , 2006, Pages 179-188

  Cooke, Evan ^a   Mao, Z Morley ^a   Jahanian, Farnam ^a  

^a UNIVERSITY OF MICHIGAN   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DISTRIBUTED DETECTORS; SCAN DETECTORS; SELF-PROPAGATING MALWARE;

ALGORITHMS; COMPUTER SIMULATION; COMPUTER WORMS; DETECTORS; DISTRIBUTED COMPUTER SYSTEMS; INTERNET; SECURITY OF DATA; SENSORS;

TELECOMMUNICATION NETWORKS;

EID: 33845582612     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DSN.2006.39     Document Type: Conference Paper

References (29)

1. M. Bailey, E. Cooke, F. Jahanian, J. Nazario, and D. Watson. The Internet Motion Sensor: A distributed blackhole monitoring system. In Proceedings of Network and Distributed System Security Symposium (NDSS '05), San Diego, CA, February 2005.
2. M. Bailey, E. Cooke, D. Watson, F. Jahanian, and J. Nazario. The Blaster Worm: Then and Now. IEEE Security & Privaey, 3(4):26-31, 2005.
3. Z. Chen, L. Gao, and K. Kwiat. Modeling the spread of active worms. In IEEE INFOCOMM, 2003.
4. Computer Associates. Win32.Agobot. http: //www3.ca.com/securityadvisor/ virusinfo/virus.aspx?id=37776, July 2004.
5. E. Cooke, M. Bailey, Z. M. Mao, D. Watson, and F. Jahanian. Toward understanding distributed blackhole placement. In Proceedings of the 2004 ACM Workshop on Rapid Malcode (WORM-04), New York, Oct 2004. ACM Press.
6. E. Cooke, F. Jahanian, and D. McPherson. The Zombie roundup: Understanding, detecting, and disrupting botnets. In Proceedings of the Steps to Reducing Unwanted Traffic on the Internet (SRUTI 2005 Workshop), Cambridge, MA, July 2005.
7. E. Cooke, Z. M. Mao, and F. Jahanian. Worm hotspots: Explaining non-uniformity in worm targeting behavior. Technical Report CSE-TR-503-04, University of Michigan, 2004.
8. eEye Digital Security. ANALYSIS: Microsoft SQL Server Sapphire Worm. January 2003.
9. K. Egevang and P. Francis. RFC 1631: The IP Network Address Translator (NAT). 1994. http://www.ietf.org/rfc/rfc1631.txt.
10. P. B. Garrett. Making, Breaking Codes: an Introduction to Cryptology. Prentice-Hall, Inc., Upper Saddle River, NJ 07458, USA, 2001.
11. J. Jung, V. Paxson, A. W. Berger, and H. Balakrishna. Fast portscan detection using sequential hypothesis testing. Proceedings 2004 IEEE Symposium on Security and Privacy, Oakland, CA, USA, May 9-12, 2004, 2004.
12. H.-A. Kim and B. Karp. Autograph: Toward Automated, Distributed Worm Signature Detection. In Proceedings of the 2004 USENIX Security Symposium, San Diego, CA, USA, August 2004.
13. A. Kumar, V. Paxson, and N. Weaver. Exploiting underlying structure for detailed reconstruction of an internet-scale event. Proceedings of the USENIX/ACM Internet Measurement Conference, Oct. 2005.
14. McAfee. W32/Sdbot.worm. http://vil.nai.com/vil/content/v_100454.htm, April 2003.
15. D. Moore. Network telescopes: Observing small or distant security events. In 11th USENIX Security Symposium, Invited talk, San Francisco, CA, Aug. 5-9 2002. Unpublished.
16. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. Inside the Slammer worm. IEEE Security & Privacy, 1(4):33-39, 2003.
17. D. Moore, G. M. Voelker, and S. Savage. Inferring Internet denial-of-service activity. In Proceedings of the Tenth USENIX Security Symposium, pages 9-22, Washington, D.C., Aug. 2001.
18. R. Pang, V. Yegneswaran, P. Barford, V. Paxson, and L. Peterson. Characteristics of Internet background radiation. In Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, pages 27-40. ACM Press, 2004.
19. M. A. Rajab, F. Monrose, and A. Terzis. On the effectiveness of distributed worm monitoring. In Proceedings of the 14th USENIX Security Symposium, Baltimore, MD, August 2005.
20. Y. Rekhter, B. Moskowitz, D. Karrenberg, G. J. de Groot, and E. Lear. RFC 1918: Address allocation for private internets, 1996. http://www.ietf.org/rfc/ rfc1918.txt.
21. Robert Graham. Decompiled Source for MS RPC DCOM Blaster Worm. http://robertgraham.com/journal/030815-blaster.c, 2003.
22. C. Shannon, D. Moore, and J. Brown. Code-Red: a case study on the spread and victims of an Internet worm. In Proceedings of the Internet Measurement Workshop (IMW), Dec. 2002.
23. C. Shannon, D. Moore, G. M. Voelker, and S. Savage. Internet quarantine: Requirements for containing self-propagating code. In INFOCOM, Dec. 21 2003.
24. S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In 6th Symposium on Operating Systems Design and Implementation (OSDI '04), pages 45-60, San Francisco, CA, Dec. 6-8 2004.
25. D. Song, R. Malan, and R. Stone. A snapshot of global Internet worm activity. FIRST Conference on Computer Security Incident Handling and Response, June 2002.
26. S. Staniford, D. Moore, V. Paxson, and N. Weaver. The top speed of flash worms. In WORM '04: Proceedings of the 2004 ACM workshop on Rapid malcode, pages 33-42. ACM Press, 2004.
27. S. Staniford, V. Paxson, and N. Weaver. How to Own the Internet in your spare time. In Proceedings of the 11th USENIX Security Symposium. USENIX, Aug. 2002.
28. The Honeynet Project. Know your enemy: Tracking botnets. http://www.honeynet.org/papers/bots/, March 2005.
29. C. C. Zou, L. Gao, W. Gong, and D. Towsley. Monitoring and early warning for Internet worms. In Proceedings of the 10th ACM conference on Computer and communication security, pages 190-199. ACM Press, 2003.