Evaluation of collaborative worm containment on the DETER testbed

DETER Community Workshop on Cyber Security Experimentation and Test 2007, DETER 2007

Volumn , Issue , 2007, Pages

  Li, L ^a   Liu, P ^a   Jhi, Y C ^a   Kesidis, G ^a  

^a PENNSYLVANIA STATE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

SCANNING; TESTBEDS;

DETER TESTBED; ENTERPRISE NETWORKS; LOCAL NETWORKS; RELAXATION ANALYSIS; SCANNING WORMS; SECURITY AGENTS; WORM DEFENSE;

NETWORK SECURITY;

EID: 78650962207     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (27)

1. EMIST project. http://emist.ist.psu.edu.
2. T. Benzel, B. Braden, D. Kim, C. Neuman, A. Joseph, K. Sklower, R. Ostrenga, and S. Schwab. Experience with DETER: A testbed for security research. In Proc. 2nd International IEEE/Create-Net Conference on Testbeds and Research Infrastructures for the Development of Networks and Communities (TridentCOM'06), Barcelona, Spain, March, 2006.
3. L. Briesemeister, P. Porras, and A. Tiwari. Model checking of worm quarantine and counter-quarantine under a group defense. Technical Report SRI-CSL-05-03, Computer Science Laboratory, SRI, 1992.
4. Shigang Chen and Yong Tang. Slowing down Internet worms. In ICDCS'04: Proceedings of the 24th International Conference on Distributed Computing Systems (ICDCS'04), pages 312-319. IEEE Computer Society, 2004.
5. Evan Cooke, Michael Bailey, Z. Morley Mao, David Watson, Farnam Jahanian, and Danny McPherson. Toward understanding distributed blackhole placement. In WORM'04: Proceedings of the 2004 ACM workshop on Rapid malcode, pages 54-64, New York, NY, 2004. ACM Press.
6. D. Dagon, X. Qin, G. Gu, W. Lee, J. Grizzard, J. Levin, and H. Owen. Honeystat: Local worm detection using honeypots. In Proceedings of The 7th International Symposium on Recent Advances in Intrusion Detection (RAID 2004), Sophia Antipolis, France, September 2004.
7. Prahlad Fogla, Monirul Sharif, Roberto Perdisci, Oleg Kolesnikov, and Wenke Lee. Polymorphic blending attacks. In Proc. 15th USENIX Security Symposium, 2006.
8. Y. Jhi, P. Liu, L. Li, Q. Gu, J. Jing, and G. Kesidis. Proactive containment of fast scanning worms through white detection. In Proceedings of 3rd International Conference on Security and Privacy in Communication Networks, September 2007.
9. G. Kc, A. Keromytis, and V. Prevelakis. Countering code-injection attacks with instruction-set randomization. In Proceedings of the 10th ACM conference on Computer and communications security, pages 272 - 280, October 2003.
10. G. Kesidis, I. Hamadeh, and S. Jiwasurat. Coupled Kermack-Mckendrick models for randomly scanning and bandwidth saturating Internet worms. ACM TOMACS, 2007.
11. S. Kornexl, V. Paxson, H. Dreger, A. Feldmann, and R. Sommer. Building a time machine for efficient recording and retrieval of high-volume network traffic. In Proc. Internet Measurement Conference 2005, Berkeley, CA, Oct, 2005.
12. L. Li, S. Jiwasurat, I. Hamadeh, P. Liu, G. Kesidis, and C. Neuman. Emulation of sequential scanning worms in large enterprises. In Proc. 2nd International IEEE/Create-Net Conference on Testbeds and Research Infrastructures for the Development of Networks and Communities (TridentCOM'06), Barcelona, Spain, March, 2006.
13. L. Li, S. Jiwasurat, P. Liu, and G. Kesidis. Emulation of single packet UDP scanning worms in large enterprises. In Proc. 19 International Teletraffic Congress (ITC19), Beijing, China, August, 2005.
14. L. Li, P. Liu, and G. Kesidis. Visual toolkit for network security experiment specification and data analysis. In VizSEC '06: Proceedings of the 3rd international workshop on Visualization for computer security, pages 7-14, New York, NY, USA, 2006. ACM Press.
15. Z. Li, M. Sanghi, Y. Chen, M. Y. Kao, and B. Chavez. Hamsa: Fast signature generation for zero-day polymorphic worms with provable attack resilience. In Proceedings of IEEE Symposium on Security and Privacy, 2006.
16. M. Liljenstam, D. Nicol, V. Berk, and R. Gray. Simulating realistic network worm traffic for worm warning system design and testing. In Proc. ACM WORM, Washington, DC, 2003.
17. J. Newsome, B. Karp, and D. Song. Polygraph: Automatic signature generation for polymorphic worms. In IEEE Security and Privacy Symposium, May 2005.
18. P. Porras, L. Biesemeister, K. Levitt, J. Rowe, K. Skinner, and A. Ting. A hybrid quarantine defense. In Proc. ACM WORM, Washington, DC, Oct. 29, 2004.
19. Moheeb Abu Rajab, Fabian Monrose, and Andreas Terzis. Worm evolution tracking via timing analysis. In WORM'05: Proceedings of the 2005 ACM workshop on Rapid malcode, pages 52-59, New York, NY, USA, 2005. ACM Press.
20. S. Schechter, J. Jung, and A. Berger. Fast detection of scanning worm infections. In Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID), September, 2004.
21. Sumeet Singh, Cristian Estan, George Varghese, and Stefan Savage. Automated worm fingerprinting. In OSDI, pages 45-60, 2004.
22. Y. Tang and S. Chen. Defending against Internet worms: A signature-based approach. In Proc. of IEEE INFOCOM'05, Miami, Florida, May 2005.
23. N. Weaver, I. Hamadeh, G. Kesidis, and V. Paxson. Preliminary results using scale-down to explore worm dynamics. In Proc. ACM WORM, Washington, DC, Oct. 2004.
24. N. Weaver, S. Staniford, and V. Paxson. Very fast containment of scanning worms. In Proc. 13th USENIX Security Symposium, 2004.
25. Matthew M. Williamson. Throttling viruses: Restricting propagation to defeat malicious mobile code. In ACSAC, pages 61-68. IEEE Computer Society, 2002.
26. V. Yegneswaran, J. Giffin, P. Barford, and S. Jha. An architecture for generating semantic-aware signatures. In Proc. 14th USENIX Security Symposium, 2005.
27. Cliff Changchun Zou, Weibo Gong, and Don Towsley. Worm propagation modeling and analysis under dynamic quarantine defense. In WORM'03: Proceedings of the 2003 ACM workshop on Rapid malcode, pages 51-60, New York, NY, 2003. ACM Press.