Worm virulence estimation for the containment of local worm outbreak

Computers and Security

Volumn 29, Issue 1, 2010, Pages 104-123

  Choi, Y H ^a   Li, L ^b   Liu, P ^a   Kesidis, G ^a  

^a The Center for Nanotechnology Education and Utilization   (United States)

^b INSTITUTE OF MICROELECTRONICS   (China)

Author keywords

Global scanning worms; Local scanning worms; Maximum likelihood estimation; Worm containment; Worm virulence estimation

Indexed keywords

DETECTION METHODS; ENTERPRISE NETWORKS; EXPERIMENTAL EVALUATION; HONEYPOTS; LOCAL NETWORKS; MAXIMUM LIKELIHOOD ESTIMATE; MAXIMUM LIKELIHOOD ESTIMATOR; NETWORK USERS; RELIABLE ESTIMATES; SCANNING WORMS; SERVICE DISRUPTIONS; SUSCEPTIBLE POPULATION; WORM CONTAINMENT; WORM OUTBREAK; WORM PROPAGATION; WORM SCANNERS;

CONTROL THEORY; DETECTORS; ESTIMATION; SCANNING;

MAXIMUM LIKELIHOOD ESTIMATION;

EID: 71649112409     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2009.07.002     Document Type: Article

References (30)

1. Andersson H., and Britton T. Stochastic epidemic models and their statistical analysis (2000), Springer-Verlag
2. Benzel T, Braden B, Kim D, Neuman C, Joseph A, Sklower K, et al. Experience with DETER: a testbed for security research. In: Proceedings of second international IEEE/create-net conference on testbeds and research infrastructures for the development of networks and communities (TridentCOM'06). Barcelona, Spain; March 2006.
3. Cert advisory ca-2001-26 nimda worm, Tech. rep.
4. 'code red ii' spreading quickly, causing damage, USA TODAY (2001). http://www.usatoday.com/tech/news/2001-08-08-code-red-2.htm
5. Cooke EM, Bailey MD, Jahanian F, Mortier R. The dark oracle: perspective-aware unused and unreachable address. In: NSDI '06: third symposium on networked systems design & implementation. San Jose, CA; 2006.
6. Daley D., and Gani J. Epidemic modeling, an introduction (1999), Cambridge University Press
7. EMIST project. http://emist.ist.psu.edu
8. Jung J, Paxson V, Berger A, Balakrishnan H. Fast portscan detection using sequential hypothesis testing. In: IEEE symposium on security and privacy 2004. Oakland, CA; 2004.
9. Jung J, Milito R, Paxson V. On the adaptive real-time detection of fast-propagating network worms. In: Proceedings of fourth gi international conference on detection of intrusions & malware, and vulnerability assessment. Lucerne, Switzerland; 2007.
10. Kesidis G., Hamadeh I., and Jiwasurat S. Coupled Kermack-Mckendrick models for randomly scanning and bandwidth saturating internet worms. Proceedings of QoS-IP (Feb. 2005), Springer-Verlag, Catania, Sicily
11. Li L, Jiwasurat S, Liu P, Kesidis G. Emulation of single packet UDP scanning worms in large enterprises. In: Proceedings of nineteenth International Teletraffic Congress (ITC19). Beijing, China; August, 2005.
12. Li L, Jiwasurat S, Hamadeh I, Liu P, Kesidis G, Neuman C. Emulation of sequential scanning worms in large enterprises. In: Proceedings of second international IEEE/create-net conference on testbeds and research infrastructures for the development of networks and communities (TridentCOM'06). Barcelona, Spain; March 2006a.
13. Li L., Liu P., and Kesidis G. Visual toolkit for network security experiment specification and data analysis. VizSEC '06: proceedings of the third international workshop on visualization for computer security (2006), ACM Press, New York, NY, USA 7-14. http://doi.acm.org/10.1145/1179576.1179579
14. Li L, Jhi Y, Liu P, Kesidis G. Evaluation of collaborative worm containment on the deter testbed. In: Proceedings of workshop on cyber security experimentation and test 2007. Boston, MA; 2007.
15. Liljenstam M, Nicol D, Berk V, Gray R. Simulating realistic network worm traffic for worm warning system design and testing. In: Proceedings of ACM WORM. Washington, DC; 2003.
16. Ljung L., and Soderstrom T. Theory and practice of recursive identification (1983), MIT Press, Cambridge, MA
17. Moore D, Shannon C, Voelker GM, Savage S. Internet quarantine: requirements for containing self-propagating code. In: Proceedings of IEEE INFOCOM. San Francisco; 2003.
18. Rajab M., Monrose F., and Terzis A. Worm evolution tracking via timing analysis. WORM '05: proceedings of the 2005 ACM workshop on rapid malcode (2005), ACM Press, New York, NY, USA 52-59. http://doi.acm.org/10.1145/1103626.1103637
19. Riordan D.Z.J., and Duponchel Y. Boundary detection and containment of local worm infections. PSRUTI'07: proceedings of the third USENIX workshop on steps to reducing unwanted traffic on the Internet (2007), USENIX Association
20. Rohloff KR, Basar T. Stochastic behavior of random constant scanning worms. In: Proceedings of IEEE conference on computer communications and networks 2005 (ICCCN 2005); 2005.
21. Schechter S, Jung J, Berger A. Fast detection of scanning worm infections. In: Proceedings of the seventh international symposium on Recent Advances in Intrusion Detection (RAID); September, 2004.
22. Sekar V., Xie Y., Reiter M.K., and Zhang H. A multi-resolution approach for worm detection and containment. DSN '06: proceedings of the international conference on dependable systems and networks (2006), IEEE Computer Society, Washington, DC, USA 189-198. http://dx.doi.org/10.1109/DSN.2006.6
23. Staniford S. Containment of scanning worms in enterprise networks. Journal of Computer Security.
24. Update: blaster worm infections spreading rapidly. http://www.networkworld.com/news/2003/0812blastinfect.html
25. Weaver N, Staniford S, Paxson V. Very fast containment of scanning worms. In: Proceedings of Thirteenth USENIX Security Symposium; 2004a.
26. Weaver N, Ellis D, Paxson V, Staniford S. Worms vs. perimeters: the case for hardLANs. In: Hot interconnects 2004; 2004b.
27. Whyte D, van Oorschot P, Kranakis E. Exposure maps: removing reliance on attribution during scan detection. In: HotSec'06: First USENIX workshop USENIX association workshop on hot topics in security; 2006.
28. Williamson M.M. Throttling viruses: restricting propagation to defeat malicious mobile code. ACSAC (2002), IEEE Computer Society 61-68
29. Zou C, Towsley D, Gong W. A firewall network system for worm defense in enterprise networks, Tech. Rep. TR-04-CSE-01, UMass; Feb. 2004.
30. Zou C., Gong W., Towsley D., and Gao L. The monitoring and early detection of internet worms. IEEE/ACM Trans. Netw. 13 5 (2005) 961-974. http://dx.doi.org/10.1109/TNET.2005.857113