Understanding divide-conquer-scanning worms

Conference Proceedings of the IEEE International Performance, Computing, and Communications Conference

Volumn , Issue , 2008, Pages 51-58

  Li, Yubin ^a   Chen, Zesheng ^a   Chen, Chao ^b  

^a Florida International University   (United States)

^b INDIANA UNIVERSITY PURDUE UNIVERSITY FORT WAYNE   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DEFENSE MECHANISMS; FUTURE INTERNETS; INTERNET WORMS; MATHEMATICAL ANALYSIS; NON-UNIFORM DISTRIBUTIONS; RANDOM SCANNING; SCANNING WORMS; SECURITY THREATS;

COMPUTER WORMS; INTERNET;

SCANNING;

EID: 62849096861     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/PCCC.2008.4745139     Document Type: Conference Paper

References (26)

1. P. Barford, R. Nowak, R. Willett, and V. Yegneswaran, "Toward a model for sources of Internet background radiation," in Proc. of the Passive and Active Measurement Conference (PAM'06), Mar. 2006.
2. Z. Chen, C. Chen, and C. Ji, "Understanding localized-scanning worms," in Proc. of 26th IEEE International Performance Computing and Communications Conference (IPCCC'07), New Orleans, LA, Apr. 2007, pp. 186-193.
3. Z. Chen, L. Gao, and K. Kwiat, "Modeling the spread of active worms," in Proc. of INFOCOM'03, vol. 3, San Francisco, CA, Apr. 2003, pp. 1890-1900.
4. Z. Chen and C. Ji, "Optimal worm-scanning method using vulnerable-host distributions," International Journal of Security and Networks: Special Issue on Computer and Network Security, vol. 2, no. 1/2, 2007.
5. Z. Chen and C. Ji, "Measuring network-aware worm spreading ability," in Proc. of INFOCOM'07, Anchorage, AK, May 2007.
6. Z. Chen, C. Ji, and P. Barford, "Spatial-temporal characteristics of malicious sources," in Proc. of INFOCOM'08 Mini-Conference, Phoenix, AZ, Apr. 2008.
7. T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, Introduction to Algorithms. The MIT Press and McGraw-Hill, 2002.
8. A. Lakhina, M. Crovella, and C. Diot, "Mining anomalies using traffic feature distributions," in Proc. of ACM SIGCOMM'05, Philadelphia, PA, Aug. 2005.
9. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver, "Inside the Slammer worm," IEEE Security and Privacy, vol. 1, no. 4, July 2003, pp. 33-39.
10. D. Moore, C. Shannon, and J. Brown, "Code-Red: a case study on the spread and victims of an Internet worm," in ACM SIGCOMM/USENIX Internet Measurement Workshop, Marseille, France, Nov. 2002.
11. P. Porras, H. Saidi, and V. Yegneswaran, "A multi-perspective analysis of the Storm (Peacomm) Worm," SRI Technical Report, Nov. 2007.
12. M. A. Rajab, F. Monrose, and A. Terzis, "On the effectiveness of distributed worm monitoring," in Proc. of the 14th USENIX Security Symposium (Security'05), Baltimore, MD, Aug. 2005, pp. 225-237.
13. D. W Richardson, S. D. Gribble, and E. D. Lazowska, "The limits of global scanning worm detectors in the presence of background noise," in Proc. of ACM Workshop on Rapid Malcode (WORM'05), Fairfax, VA, Nov. 2005, pp. 60-70.
14. C. Shannon and D. Moore, "The spread of the Witty worm," IEEE Security and Privacy, vol. 2, no 4, Jul-Aug 2004, pp. 46-50.
15. S. Singh, C. Estan, G. Varghese, and S. Savage, "Automated worm fingerprinting," in Proc. of the 6th ACM/USENIX Symposium on Operating System Design and Implementation (OSDI'04), San Francisco, CA, Dec. 2004, pp. 45-60.
16. S. Staniford, V. Paxson, and N. Weaver, "How to Own the Internet in your spare time," in Proc. of the 11th USENIX Security Symposium (Security'02), San Francisco, CA, Aug. 2002.
17. M. Vojnovic, V. Gupta, T. Karagiannis, and C. Gkantsidis, "Sampling strategies for epidemic-style information dissemination," in Proc. of INFOCOM'08, Phoenix, AZ, Apr. 2008.
18. J. Xia, S. Vangala, J. Wu, L. Gao, and K. Kwiat, "Effective worm detection for various scan techniques," Journal of Computer Security, vol. 14, no. 4, 2006, pp. 359-387.
19. W Yu, X. Wang, D. Xuan, and D. Lee, "Effective detection of active smart worms with varying scan rate," in Proc. of IEEE Communications Society/CreateNet International Conference on Security and Privacy in Communication Networks (SecureComm'06), Aug. 2006.
20. W Yu, X. Wang, D. Xuan, and W. Zhao, "On detecting camouflaging worm," in Proc. of Annual Computer Security Applications Conference (ACSAC06), Dec. 2006.
21. C. C. Zou, D. Towsley, and W Gong, "On the performance of Internet worm scanning strategies," Elsevier Journal of Performance Evaluation, vol. 63. no. 7, July 2006, pp. 700-723.
22. C. C. Zou, D. Towsley, W. Gong, and S. Cai, "Advanced routing worm and its security challenges," Simulation: Transactions of the Society for Modeling and Simulation International, vol. 82, no. 1, 2006, pp. 75-85.
23. CAIDA, "Network telescope," http://www.caida.org/research/ security/telescope/.
24. Computing Research Association, "Grand research challenges in information security & assurance," http://www.cra.org/Activities/grand. challenges/security/home.html.
25. The CAIDA Dataset on the Witty Worm - March 19-24, 2004, Colleen Shannon and David Moore, http://www.caida.org/data/passive/witty-worm-dataset.xml. Support for the Witty Worm Dataset and the UCSD Network Telescope are provided by Cisco Systems, Limelight Networks, the US Department of Homeland Security, the National Science Foundation, DARPA, Digital Envoy, and CAIDA Members.
26. Wikipedia, "Logistic function," http://en.wikipedia.org/wiki/ Logistic-function