Misleading and defeating importance-scanning malware propagation

Proceedings of the 3rd International Conference on Security and Privacy in Communication Networks, SecureComm

Volumn , Issue , 2007, Pages 250-259

  Gu, Guofei ^a   Chen, Zesheng ^a   Porras, Phillip ^b   Lee, Wenke ^a  

^a GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

^b SRI INTERNATIONAL   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ADDRESS SPACE; MALWARE;

COMPUTER NETWORKS;

SCANNING;

EID: 51349154278     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SECCOM.2007.4550340     Document Type: Conference Paper

References (38)

1. Z. Chen and C. Ji, "A self-learning worm using importance scanning," in ACM CCS Workshop on Rapid Malcode (WORM'05), 2005.
2. S. Staniford, V. Paxson, and N. Weaver, "How to Own the internet in your spare time," in 11th USENIX Security Symposium (Security '02), 2002.
3. N. Weaver, V. Paxson, S. Staniford, and R. Cunningham, "A taxonomy of computer worms," in First ACM Workshop on Rapid Malcode (WORM'03), 2003.
4. C. C. Zou, W. Gong, and D. Towsley, "Code red worm propagation modeling and analysis," in 9th ACM Conference on Computer and Communication Security (CCS'02), 2002.
5. C. Shannon and D. Moore, "The spread of the witty worm," IEEE Security and Privacy Magazine, 2004.
6. M. Bailey, E. Cooke, F. Jahanian, J. Nazario, and D. Watson, "The internet motion sensor: A distributed blackhole monitoring system," in Network and Distributed System Security Symposium (NDSS'05), 2005.
7. C. Zou, L. Gao, W. Gong, and D. Towsley, "Monitoring and early warning of internet worms," in ACM Conference on Computer and Communications Security (CCS'03), 2003.
8. J. Wu, S. Vanagala, L. Gao, and K. Kwiat, "An effective architecture and algorithm for detecting worms with various scan techniques," in ISOC Network and Distributed System Security Symposium (NDSS'04), 2004.
9. Y. Pryadkin, R. Lindell, J. Bannister, and R. Govindan, "An empirical evaluation of ip address space occupancy," USC/ISI, Tech. Rep. ISI-TR-598, 2004.
10. "Distributed intrusion detection system (dshield)," http://www.dshield.org.
11. M. A. Rajab, F. Monrose, and A. Terzis, "On the effectiveness of distributed worm monitoring," in 14th Usenix Security Symposium (Security'05), 2005.
12. C. C. Zou, D. Towsley, W. Gong, and S. Cai, "Routing worm: A fast, selective attack worm based on ip address information," in 19th ACM/IEEE/SCS Workshop on Principles of Advanced and Distributed Simulation (PADS'05), 2005.
13. M. Rajab, F. Monrose, and A. Terzis, "Fast and evasive attacks: Highlighting the challenges ahead," in 9th International Symposium on Recent Advances in Intrusion Detection (RAID'04), 2006.
14. S. Staniford, D. Moore, V. Paxson, and N. W. Proc, "The top speed of flash worms," in ACM CCS Workshop on Rapid Malcode (WORM'04), 2004.
15. Z. Chen, L. Gao, and K. Kwiat, "Modeling the spread of active worms," in IEEE INFOCOM'03, 2003.
16. V. Yegneswaran, P. Barford, and D. Plonka, "On the design and utility of internet sinks for network abuse monitoring," in Symposium on Recent Advances in Intrusion Detection (RAID'04), 2004.
17. D. Moore, "Network telescopes: Observing small or distant security events," in 11th USENIX Security Symposium (Security'02), 2002.
18. Z. Chen and C. Ji, "Measuring network-aware worm spreading ability," in IEEE INFOCOM'07, 2007.
19. "Labrea tarpit project," http://labrea.sourceforge.net/.
20. U. Shankar and V. Paxson, "Active mapping: Resisting nids evasion without altering traffic," in IEEE Symposium on Security and Privacy (Oakland'03), 2003.
21. E. Cooke, M. Bailey, F. Jahanian, and R. Mortier, "The dark oracle: Perspective-aware unused and unreachable address discovery," in 3rd Symposium on Networked Systems Design and Implementation (NSDI'06), 2006.
22. N. Provos, "A virtual honeypot framework," in 13th USENIX Security Symposium (Security'04), 2004.
23. M. Vrable, J. Ma, J. Chen, D. Moore, E. Vandekieft, A. Snoeren, G. Voelker, and S. Savage, "Scalability, fidelity and containment in the potemkin virtual honeyfarm," in ACM SOSP'05, 2005.
24. W Cui, V. Paxson, N. Weaver, and R. H. Katz, "Protocol-independent adaptive replay of application dialog," in 13th Annual Network and Distributed System Security Symposium (NDSS'06), 2006.
25. W. Cui, V. Paxson, and N. Weaver, "Gq: Realizing a system to catch worms in a quarter million places," ICSI, Tech. Rep. TR-06-004, 2006.
26. J. Jung, V. Paxson, A. W. Berger, and H. Balakrishnan, "Fast portscan detection using sequential hypothesis testing," in IEEE Symposium on Security and Privacy (Oakland'04), 2004.
27. N. Weaver, S. Staniford, and V. Paxson, "Very fast containment of scanning worms," in 13th USENIX Security Symposium (Security'04), 2004.
28. M. Locasto, J. Parekh, A. Keromytis, and S. Stolfo, "Towards collaborative security and p2p intrusion detection," in 2005 IEEE Workshop on Information Assurance and Security, 2005.
29. V. Yegneswaran, P. Barford, and S. Jha, "Global intrusion detection in the domino overlay system," in Network and Distributed Security Symposium (NDSS'04), 2004.
30. Z. Chen and C. Ji, "Optimal worm-scanning method using vulnerablehost distributions," International Journal of Security and Networks (IJSN), special issue on "Computer and Network Security.", 2006.
31. G. Gu, M. Sharif, X. Qin, D. Dagon, W. Lee, and G. Riley, "Worm detection, early warning and response based on local victim information," in 20th Annual Computer Security Applications Conference (ACSAC'04), 2004.
32. H. project, Know your enemy: Learning about Security Threats. Pearson Education, 2004.
33. K. Borders, L. Falk, and A. Prakash, "Opening: Opening networks to reduce network attacks on legitimate services," University of Michigan, Tech. Rep. CSE-TR-517-06, 2006.
34. J. Bethencourt, J. Franklin, and M. Vernon, "Mapping internet sensors with probe response attacks," in 14th USENIX Security Symposium (Security'05), 2005.
35. S. Sinha, M. Bailey, and F. Jahanian, "Shedding light on the configuration of dark addresses," in ISOC Network and Distributed System Security Symposium (NDSS'07), 2007.
36. T. Holz and F. Raynal, "Detecting honeypots and other suspicious environments," in Sixth Annual IEEE Systems, Man and Cybernetics (SMC) Information Assurance Workshop (IAW'05), 2005.
37. C. C. Zou and R. Cunningham, "Honeypot-aware advanced botnet construction and maintenance," in International Conference on Dependable Systems and Networks (DSN'06), 2006.
38. D. Brumley, L.-H. Liu, P. Poosankam, and D. Song, "Design space and analysis of worm defense strategies," in 2006 ACM Symposium on Information, Computer, and Communication Security (ASIACCS '06), 2006.