An information-theoretic view of network-aware malware attacks

IEEE Transactions on Information Forensics and Security

Volumn 4, Issue 3, 2009, Pages 530-541

  Chen, Zesheng ^a   Ji, Chuanyi ^b  

^a The Department of Electrical and Computer Engineering   (United States)

^b GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

Attack models; Network security; Performance metrics

Indexed keywords

ATTACK MODELS; DEFENSE STRATEGY; HOST-BASED; INFECTION RATES; INFORMATION BIT; LARGE DATASETS; MALWARE ATTACKS; MALWARE PROPAGATION; MALWARES; NETWORK VULNERABILITY; NONUNIFORM; NONUNIFORMITY; PERFORMANCE METRICS; RENYI ENTROPY; RENYI INFORMATION; SCANNING ALGORITHMS; SCANNING METHODS; SPREADING SPEED;

COMPUTER CRIME; ENTROPY; INFORMATION THEORY; INTERNET; METRIC SYSTEM; SCANNING;

NETWORK SECURITY;

EID: 69749100394     PISSN: 15566013     EISSN: None     Source Type: Journal    
DOI: 10.1109/TIFS.2009.2025847     Document Type: Article

References (44)

1. P. Barford, R. Nowak, R. Willett, and V. Yegneswaran, "Toward a model for sources of Internet background radiation," in Proc. Passive and Active Measurement Conf. (PAM'06), Adelaide, Australia, Mar. 2006.
2. S. M. Bellovin, B. Cheswick, and A. Keromytis, "Worm propagation strategies in an IPv6 Internet," Login, vol.31, no.1, pp. 70-76, Feb. 2006.
3. D. Brumley, L. Liu, P. Poosankam, and D. Song, "Design space and analysis of worm defense strategies," in ACM Symp. InformAtion, Computer and Communications Security (ASIACCS), Taipei, Taiwan, Mar. 2006.
4. C. Cachin, "Entropy Measures and Unconditional Security in Cryptography," Ph.D. thesis, Swiss Federal Institute of Technology, Zurich, 1997.
5. Z. Chen, C. Chen, and C. Ji, "Understanding localized-scanning worms," in Proc. 26th IEEE Int. Performance Computing and Communications Conf. (IPCCC'07), New Orleans, LA, Apr. 2007, pp. 186-193.
6. Z. Chen, L. Gao, and K. Kwiat, "Modeling the spread of active worms," in Proc. INFOCOM'03, San Francisco, CA, Apr. 2003, vol.3, pp. 1890-1900.
7. Z. Chen and C. Ji, An Information-Theoretical View of Network-Aware Malware Attacks, Tech. Rep. arXiv:0805.0802v2, 2008 [Online]. Available: http://arxiv.org/abs/0805.0802
8. Z.Chen and C.Ji, "Optimal worm-scanning method using vulnerable-host distributions," Int. J. Security Netw., Special Issue on Comput. Netw. Security, Vol.2, no. 1/2, pp.71-80, 2007
9. Z. Chen and C. Ji, "Measuring network-aware worm spreading ability," in Proc. INFOCOM'07, Anchorage, AK, May 2007.
10. Z. Chen and C. Ji, "A self-learning worm using importance scanning," in Proc. ACM/CCS Workshop Rapid Malcode (WORM'05), Fairfax, VA, Nov. 2005, pp. 22-29.
11. Z. Chen, C. Ji, and P. Barford, "Spatial-temporal characteristics of malicious sources," in Proc. INFOCOM'08 Mini-Conf., Phoenix, AZ, Apr. 2008.
12. T. M. Cover and P. E. Hart, "Nearest neighbor pattern classification," IEEE Trans. Inf. Theory, vol.IT-13, no.1, pp. 21-27, Jan. 1967.
13. T. M. Cover and J.A.Thomas, Elements of Information Theory. New York: Wiley, 1991.
14. H. Feng, A. Kamra, V. Misra, and A. D. Keromytis, "The effect of DNS delays on worm propagation in an IPv6 Internet," in Proc. IN-FOCOM'05, Miami, FL, Mar. 2005, vol.4, pp. 2405-2414.
15. G. Gu, Z. Chen, P. Porras, and W. Lee, "Misleading and defeating importance-scanning malware propagation," in Proc. 3rd Int. Conf. Security Privacy in Communication Networks (SecureComm '07), Nice, France, Sep. 2007.
16. G. Gu, M. Sharif, X. Qin, D. Dagon, W. Lee, and G. Riley, "Worm detection, early warning and response based on local victim information," in Proc. 20th Ann. Computer Security Applications Conf. (ACSAC'04), Tucson, AZ, Dec. 2004.
17. E. Kohler, J. Li, V. Paxson, and S. Shenker, "Observed structure of addresses in IP traffic," in ACM SIGCOMM Internet Measurement Workshop, Marseille, France, Nov. 2002.
18. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver, "Inside the Slammer worm," IEEE Security Privacy, vol.1, no.4, pp. 33-39, Jul. 2003.
19. D. Moore, C. Shannon, and J. Brown, "Code-Red: A case study on the spread and victims of an Internet worm," in ACM SIGCOMM Internet Measurement Workshop, Marseille, France, Nov. 2002.
20. Y. Pryadkin, R. Lindell, J. Bannister, and R. Govindan, An Empirical Evaluation of IP Address Space Occupancy, USC/Information Sciences Inst., Tech. Rep. ISI-TR-2004-2598, Nov. 2004.
21. M. A. Rajab, F. Monrose, and A. Terzis, "On the effectiveness of distributed worm monitoring," in Proc. 14th USENIX Security Symp. (Security'05), Baltimore, MD, Aug. 2005, pp. 225-237.
22. A. Renyi, "Some fundamental questions of information theory," in Selected Papers of Alfred Renyi. Budapest: Akademiai Kiado, 1976, vol.2, pp. 526-552.
23. A. Renyi, Probability Theory. New York: Elsevier, 1970.
24. S. M. Ross, Simulation, 3rd ed. New York: Academic, 2002.
25. C. Shannon and D. Moore, "The spread of the Witty worm," IEEE Security Privacy, vol.2, no.4, pp. 46-50, Jul./Aug. 2004.
26. S. Staniford, V. Paxson, and N. Weaver, "How to 0wn the Internet in your spare time," in Proc. 11th USENIX Security Symp. (Security'02), San Francisco, CA, Aug. 2002.
27. J. Twycross and M. M. Williamson, "Implementing and testing a virus throttle," in Proc. 12th USENIX Security Symp. (Security '03), Washington, DC, Aug. 2003, pp. 285-294.
28. M. Vojnovic, V. Gupta, T. Karagiannis, and C. Gkantsidis, "Sampling strategies for epidemic-style information dissemination," in Proc. INFOCOM'08, Phoenix, AZ, Apr. 2008.
29. V. Yegneswaran, P. Barford, and D. Plonka, "On the design and utility of Internet sinks for network abuse monitoring," in Proc. Symp. Recent Advances in Intrusion Detection (RAID '04), Sophia Antipolis, France, 2004.
30. C. C. Zou, L. Gao, W. Gong, and D. Towsley, "Monitoring and early warning for Internet worms," in 10th ACM Conf. Computer and Communication Security (CCS'03), Washington, DC, Oct. 2003.
31. C. C. Zou, D. Towsley, and W. Gong, "On the performance of Internet worm scanning strategies," Elsevier J. Performance Evaluation, vol.63, no.7, pp. 700-723, Jul. 2006.
32. C. C. Zou, D. Towsley, W. Gong, and S. Cai, "Advanced routing worm and its security challenges," Simulation: Trans. Soci. Modeling Simulation Int., vol.82, no.1, pp. 75-85, 2006.
33. CERT Advisory CA-2001-2026 Nimda Worm CERT Coordination Center, Dec. 2008 [Online]. Available: http://www.cert.org/advi-sories/CA-2001-26.html
34. "Code Red II:" Another Worm Exploiting Buffer Overflow in IIS Indexing Service DLL CERT Coordination Center, CERT Incident Note IN-2001-2009, Dec. 2008 [Online]. Available: http://www.cert.org/inci-dent-notes/IN-2001 -09 .html
35. Distributed Intrusion Detection System (DShield) Dec. 2008 [Online]. Available: http://www.dshield.org/
36. ANALYSIS: Blaster Worm eEye Digital Security, Dec. 2008 [Online]. Available: http://research.eeye.com/html/advisories/pub-lished/AL20030811.html
37. Internet Protocol V4 Address Space Dec. 2008 [Online]. Available: http://www.iana.org/assignments/ipv4-address-space
38. UROULETTE Dec. 2008 [Online]. Available: http://www.uroulette. com/
39. Agobot (Computer Worm) Wikipedia, Dec. 2008 [Online]. Available: http://en.wikipedia.org/wiki/Agobot-(computer-worm)
40. Samy (XSS) Wikipedia, Dec. 2008 [Online]. Available: http://en. wikipedia.org/wiki/Samy-(XSS)
41. Self-Information Wikipedia, Dec. 2008 [Online]. Available: http://en. wikipedia.org/wiki/Self-information
42. S. Venkataraman, S. Sen, O. Spatscheck, P. Haffner, and D. Song, "Exploiting network structure for proactive spam mitigation," in Proc. 16th USENIX Security Symp. (Security '07), Boston, MA, Aug. 2007.
43. S. Shakkottai and R. Srikant, "Peer to peer networks for defense against Internet worms," IEEE J. Sel. Areas Commun., vol.25, no.9, pp. 1745-1752, Dec. 2007.
44. M. Vojnovic and A. J. Ganesh, "On the race of worms, alerts, and patches," IEEE Trans. Netw., vol.16, no.5, pp. 1066-1079, Oct. 2008.