Optimal worm-scanning method using vulnerable-host distributions

International Journal of Security and Networks

Volumn 2, Issue 1-2, 2007, Pages 71-80

  Chen, Zesheng ^a   Ji, Chuanyi ^a  

^a GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

game theory; importance scanning; modelling; security; worm propagation

Indexed keywords

EID: 34548366188     PISSN: 17478405     EISSN: 17478413     Source Type: Journal    
DOI: 10.1504/ijsn.2007.012826     Document Type: Article

References (24)

1. Chen, Z., Gao, L. and Kwiat, K. (2003) ‘Modeling the spread of active worms’, Proceedings of INFOCOM’03, Vol. 3, San Francisco, CA, April, pp.1890–1900.
2. Chen, Z. and Ji, C. (2005a) ‘A self-learning worm using importance scanning’, Proceedings ACM/CCS Workshop on Rapid Malcode (WORM’05), Fairfax, VA, November, pp.22–29.
3. Chen, Z. and Ji, C. (2005b) ‘Importance-scanning worm using vulnerable-host distribution’, Proceedings 48th Annual IEEE Global Telecommunications Conference (GLOBECOM’05), St. Louis, MO, November.
4. Daley, D.J. and Gani, J. (1999) Epidemic Modelling: An Introduction, Cambridge, UK: Cambridge University Press.
5. Distributed Intrusion Detection System (DShield) (2000) Available at: http://www.dshield.org/.
6. Feng, H., Kamra, A., Misra, V. and Keromytis, A.D. (2005) ‘The effect of DNS delays on worm propagation in an IPv6 Internet’, Proceedings of INFOCOM’05, Vol. 4, Miami, FL, March, pp.2405–2414.
7. Heidelberger, P. (1995) ‘Fast simulation of rare events in queueing and reliability models’, ACM Transactions on Modeling and Computer Simulation, Vol. 5, No. 1, January, pp.43–85.
8. Internet Protocol V4 Address Space (2006) Available at: http://www.iana.org/assignments/ipv4-address-space.
9. Ma, J., Voelker, G.M. and Savage, S. (2005) ‘Self-stopping worms’, Proceedings ACM/CCS Workshop on Rapid Malcode (WORM’05), Fairfax, VA, November, pp.12–21.
10. Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S. and Weaver, N. (2003) ‘Inside the Slammer worm’, IEEE Security and Privacy, Vol. 1 No. 4, July, pp.33–39.
11. Moore, D., Shannon, C. and Brown, J. (2002) ‘Code-red: a case study on the spread and victims of an Internet worm’, ACM SIGCOMM/USENIX Internet Measurement Workshop, Marseille, France, November.
12. Owen, G. (2004) Game Theory, New York: Academic Press.
13. Rajab, M.A., Monrose, F. and Terzis, A. (2005) ‘On the effectiveness of distributed worm monitoring’, Proceedings of the 14th USENIX Security Symposium (Security’05), Baltimore, MD, August, pp.225–237.
14. Shannon, C. and Moore, D. (2004) ‘The spread of the Witty worm’, IEEE Security andPrivacy, Vol. 2, No. 4, July-August, pp.46–50.
15. Smith, PJ., Shafi, M. and Gao, H. (1997) ‘Quick simulation: a review of importance sampling techniques in communications systems’, IEEE Journal of Selected Areas Communication, Vol. 15, May, pp.597–613.
16. Staniford, S., Moore, D., Paxson, V. and Weaver, N. (2004) ‘The top speed of flash worms’, Proceedings ofthe ACM/CCS Workshop on Rapid Malcode (WORM’04), Washington DC, October, pp.33–42.
17. Staniford, S., Paxson, V. and Weaver, N. (2002) ‘How to Own the internet in your spare time’, Proceedings of the 11th USENIX Security Symposium(Security’02), San Francisco, CA, August.
18. The CAIDA Dataset on the Witty Worm (2004) Colleen Shannon and David Moore, Available at: http://www.caida.org/passive/witty/. Support for the Witty Worm Dataset and the UCSD Network Telescope are provided by Cisco Systems, Limelight Networks, the US Department of Homeland Security, the National Science Foundation, and CAIDA, DARPA, Digital Envoy and CAIDA Members.
19. Wu, J., Vangala, S., Gao, L. and Kwiat, K. (2004) ‘An effective architecture and algorithm for detecting worms with various scan techniques’, Proceedings of the 11th Annual Network and Distributed System Security Symposium (NDSS’04), San Diego, CA, February.
20. Xing, S. and Paris, B-P. (2003a) ‘Mapping the growth of the internet’, Proceedings of IEEE 2003 International Conference on Computer Communications and Networks, Dallas, TX, October, pp.199–204.
21. Xing, S. and Paris, B-P. (2003b) ‘Measuring the size of the Internet via importance sampling’, IEEE Journal on Selected Areas in Communications, Vol. 21, No. 6, August 2003, pp.922–933.
22. Zou, C.C., Gao, L., Gong, W. and Towsley, D. (2003) ‘Monitoring and early warning for internet worms’, Tenth ACM Conference on Computer and Communication Security (CCS’03), Washington, DC, October.
23. Zou, C.C., Towsley, D., Gong, W. and Cai, S. (2005) ‘Routing worm: a fast, selective attack worm based on IP address information’, Proceedings of the 19thACM/IEEE/SCS Workshop on Principles of Advanced and Distributed Simulation (PADS’05), Monterey, CA, June.
24. Zou, C.C., Towsley, D. and Gong, W. (2006) ‘On the performance of internet worm scanning strategies’, Elsevier Journal of Performance Evaluation, Vol. 63, No. 7, pp.700–723.