On detecting active worms with varying scan rate

Computer Communications

Volumn 34, Issue 11, 2011, Pages 1269-1282

  Yu, Wei ^a   Wang, Xun ^b   Champion, Adam ^b   Xuan, Dong ^b   Lee, David ^b  

^a TOWSON UNIVERSITY   (United States)

^b The Ohio State University   (United States)

Author keywords

Anomaly detection; Varying scan rate; Worm attacks

Indexed keywords

ACTIVE WORMS; ANOMALY DETECTION; DETECTION SCHEME; DYNAMIC DECISION; DYNAMIC DETECTION; INTERNET TRACES; PERFORMANCE EVALUATION; RESEARCH EFFORTS; SCAN RATES; SECURITY THREATS; STATISTICAL FEATURES; VARYING SCAN RATE; WORM ATTACKS; WORM DETECTION;

INTERNET; TELECOMMUNICATION NETWORKS;

COMPUTER CRIME;

EID: 79957686762     PISSN: 01403664     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comcom.2010.10.014     Document Type: Article

References (86)

1. D. Moore, C. Shannon, J. Brown, Code-red: a case study on the spread and victims of an internet worm, in: Proceedings of the 2th Internet Measurement Workshop (IMW), Marseille, France, November 2002.
2. D. Moore, V. Paxson, and S. Savage Inside the slammer worm IEEE Magazine of Security and Privacy 1 4 2003 3 39
3. CERT, CERT/CC advisories, .
4. The Honeynet Project and Research Alliance, Know your enemy: Tracking botnets, 2005, .
5. P.R. Roberts, Zotob Arrest Breaks Credit Card Fraud Ring, .
6. R. Naraine, Botnet Hunters Search for Command and Control Servers, .
7. P. Wang, S. Sparks, and C.C. Zou An advanced hybrid peer-to-peer botnet IEEE Transactions on Dependable and Secure Computing 7 2 2010 113 127
8. W32/MyDoom.B Virus, .
9. W32.Sircam.Worm@mm, .
10. Worm.ExploreZip, .
11. X.F. Wang, Z. Li, J. Xu, M. Reiter, C. Kil, J. Choi, Packet vaccine: Black-box exploit detection and signature generation, in: Proceedings of the 13th ACM Conference on Computer and Communication Security (CCS), Alexandria, VA, October/November 2006.
12. J.Z. Kolter, M.A. Maloof, Learning to detect malicious executables in the wild, in: Proceedings of the 10th ACM International Conference on Knowledge Discovery and Data Mining (SIGKDD), Seattle, WA, August 2004.
13. M.G. Schultz, E. Eskin, E. Zadok, S.J. Stolfo, Data mining methods for detection of new malicious executables, in: Proceedings of IEEE Symposium on Security and Privacy (S & P), Oakland, CA, May 2001.
14. M. Christodorescu, S. Jha, S.A. Seshia, D. Song, R.E. Bryant, Semantics-aware malware detection, in: Proceedings of IEEE Symposium on Security and Privacy (S & P), Oakland, CA, May 2005.
15. Z.S. Chen, L.X. Gao, K. Kwiat, Modeling the spread of active worms, in: Proceedings of the IEEE Conference on Computer Communications (INFOCOM), San Francisco, CA, March 2003.
16. C.C. Zou, W Gong, D. Towsley, Code red worm propagation modeling and analysis, in: Proceedings of the 9th ACM Conference on Computer and Communication Security (CCS), Washington, DC, November 2002.
17. C. Zou, W B. Gong, D. Towsley, L.X. Gao, Monitoring and early detection for internet worms, in: Proceedings of the 10th ACM Conference on Computer and Communication Security (CCS), Washingtion, DC, October 2003.
18. S. Schechter, J. Jung, A.W. Berger, Fast Detection of Scanning Worm Infections, in: Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID), September 2004.
19. J. Wu, S. Vangala, L.X. Gao, An effective architecture and algorithm for detecting worms with various scan techniques, in: Proceedings of the 11th IEEE Network and Distributed System Security Symposium (NDSS), San Diego, CA, Febrary 2004.
20. S. Venkataraman, D. Song, P. Gibbons, A. Blum, New streaming algorithms for superspreader detection, in: Proceedings of the 12th Annual Network and Distributed Systems Security Symposium (NDSS), San Diego, CA, Febrary 2005.
21. C. Zou, D. Towsley, W. Gong, Email worm modeling and defense, in: Proceedings of the 13th International Conference on Computer Communications and Networks (ICCCN), Chicago, IL, October 2004.
22. W. Yu, S. Chellappan C. Boyer, D. Xuan, Peer-to-peer system-based active worm attacks: Modeling and analysis, in: Proceedings of IEEE International Conference on Communication (ICC),Seoul, Korea, May 2005.
23. R. Kumar, D. Yao, A. Bagchi, K.W. Ross, and D. Rubensteinn Fluid modeling of pollution proliferation in p2p networks Proceedings of ACM Joint International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) 2006 St. Malo France
24. M. Mannan, P.C. Oorschot, Instant messaging worms, analysis and countermeasures, in Proceedings of the 3rd Workshop on Rapid Malcode (WORM), Fairfax, VA, November 2005.
25. J. Mirkovic, and P. Reiher A taxonomy of DDOS attack and DDOS defense mechanisms ACM SIGCOMM Computer Communication Review (CCR) 34 2 2004 39 54
26. J. Bethencourt, J. Frankin, M. Vernon, Mapping internet sensors with probe response attacks, in: Proceedings of the 14th USNIX Security Symposium (SECURITY), Baltimore, MD, July-August 2005.
27. Y. Shinoda, K. Ikai, M. Itoh, Vulnerabilities of passive internet threat monitors, in: Proceedings of the 14th USNIX Security Symposium (SECURITY), Baltimore, MD, July-August 2005.
28. X. Wang, W. Yu, X. Fu, D. Xuan, W. Zhao, iLOC: An invisible LO-Calization Attack to Internet Threat Monitoring Systems, in: Proceedings of the 27th IEEE International Conference on Computer Communications (INFOCOM) Mini-conference, Phoenix, AZ, Apil 2008.
29. X. Fu, W. Yu, D. Cheng, X. Tan, K. Streff, S. Graham, On recognizing virtual honeypots and countermeasures, in: Proceedings of the IEEE International Symposium on Dependable, Autonomic and Secure Computing (DASC), Indianapolis, Indiana, September 2006.
30. Zdnet, Smart worm lies low to evade detection, .
31. S. Staniford, V. Paxson, N. Weaver, How to own the internet in your spare time, in: Proceedings of the 11th USENIX Security Symposium (SECURITY), San Francisco, CA, August 2002.
32. R.M. Anderson, and R.M. May Infectious Diseases of Humans: Dynamics and Control 1991 Oxford University Press Oxford
33. SANS, Internet Storm Center, .
34. M. Bailey, E. Cooke, F. Jahanian, J. Nazario, D. Watson, The internet motion sensor: A distributed blackhole monitoring system, in: Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS),San Diego, CA, February 2005.
35. V. Yegneswaran, P. Barford, D. Plonka, On the design and utility of internet sinks for network abuse monitoring, in: Proceeding of Symposium on Recent Advances in Intrusion Detection (RAID), Pittsburgh, PA, September 2003.
36. D. Moore, Network telescopes: Observing small or distant security events, in: Invited Presentation at the 11th USENIX Security Symposium (SECURITY), San Francisco, CA, August 2002.
37. Cooperative Association for Internet Data Analysis, Dynamic Graphs of the Nimda Worm, .
38. Security@cisco, Worm mitigation technical details, .
39. Arbor Neworks, Infrastructure Security Solutions for Service Providers from Arbor Networks, .
40. N. Weaver, S. Staniford, V. Paxson, Very fast containment of scanning worms, in: Proceedings of the 13th USENIX Security Symposium (SECURITY), San Diego, CA, August 2004.
41. J. Jung, V. Paxson, A.W. Berger, H. Balakrishnan, Fast portscan detection using sequential hypothesis testing, in: Proceedings of the 25th IEEE Symposium on Security and Privacy (S & P), Oakland, CA, May 2004.
42. G.F. Gu, D. Dagon, M.I. Sharif X.Z. Qin, W. Lee, G.F. Riley, Worm detection, early warning, and response based on local victim information, in: Proceedings of the 20th Annual Computer Security Applications Conference (ACSAC), Miami, FL, December 2004.
43. R. Perdisci, O. Kolesnikov, P. Fogla, M. Sharif, and W. Lee Polymorphic blending attacks Proceeding of the 15th USENIX Security Symposium (SECURITY) 2006 Vancouver B.C.
44. S. Singh, C. Estan, G. Varghese, S. Savage, Automated worm fingerprinting, in: Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation (OSDI), San Francisco, CA, December 2004.
45. H. Kim, B. Karp, Autograph: Toward automated, distributed worm signature detection, in: Proceedings of the 13th USENIX Security Symposium (SECURITY), San Diego, CA, August 2004.
46. Dshield.org, Distributed Intrusion Detection System, 2005, .
47. D. Goldsmith, Incidents Maillist: Possible Code-Red Connection Attempts, .
48. J. Ma, G.M. Voelker, S. Savage, Self-stopping worms, in: Proceedings of the ACM Workshop on Rapid Malcode (WORM), Washington D.C, November 2005.
49. D. Bruschi, L. Martignoni, M. Monga, Detecting self-mutating malware using control flow graph matching, in: Proceedings of the Conference on Detection of Intrusions and Malware and Vulnerability Assessment (DIMVA), Berlin, Germany, July 2006.
50. D. Bruschi, L. Martignoni, M. Monga, Detecting self-mutating malware using control flow graph matching, in: Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), Berlin, Germany, July 2006.
51. MetaPHOR, .
52. P. Ferrie, P. Szor. Zmist, Zmist opportunities, Virus Bullettin, .
53. Monirul Sharif, Jonathon Giffin, Wenke Lee, Andrea Lanzi, Impeding malware analysis using conditional code obfuscation, in: Proceedings of the 15th IEEE Network and Distributed System Security Symposium (NDSS), San Diego, CA, February 2008.
54. Igor V. Popov, Saumya K. Debray, Gregory R. Andrews, Binary obfuscation using signals, in: Proceedings of the 17th USENIX Security Symposium (SECURITY), San Jose, CA, July 2008.
55. M. Christodorescu, S. Jha, Testing malware detectors, in: Proceedings of the 2004 ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), Boston, MA, July 2004.
56. Linux.com, Understanding Stealth Scans: Forewarned is Forearmed, .
57. Solar Designer, Designing and Attacking Port Scan Detection Tools, .
58. C.E. Shannon, and W. Weaver The Mathematical Theory of Communication 1949 University of Illinois Press
59. R. Moddemeijer On estimation of entropy and mutual information of continuous distributions Signal Processing 16 3 1989 233 246
60. R.A. Kemmerer, and G. Vigna Intrusion detection: a brief history and overview IEEE Computer 35 4 2002 27 30
61. D.E. Denning An intrusion detection model IEEE Transactions on Software Engineering 13 2 1987 222 232
62. A. Lakhina, M. Crovella, C. Diot, Diagnosing networkwide traffic anomalies, in: Proceedings of ACM SIGCOMM, Portland, OR, August 2004.
63. K. El-Arini, K. Killourhy, Bayesian detection of router configuration anomalies, in: Proceedings of 2005 ACM SIGCOMM Workshop on Mining Network Data (MineNet), Philadelphia, PA, August 2005.
64. W K. Lee, S. Stolfo, K. Mok, A data mining framework for building intrusion detection models, in: Proceedings of the 1999 IEEE Symposium on Security and Privacy (S & P), Oakland, CA, May 1999.
65. S. Theodoridis, and K. Koutroumbas Pattern Recognition Second ed. 2003 Elsevier Science
66. D. Wagner, D. Dean, Intrusion detection via static analysis, in: Proceedings of IEEE Symposium on Security and Privacy (S & P), Oakland, CA, May 2001.
67. D. Gao, M. Reiter, D. Song, Behavioral distance for intrusion detection, in Proceedings of Symposium on Recent Advance in Intrusion Detection (RAID), Seattle, WA, September 1999.
68. H.H Feng, J.T. Giffin, Y. Huang, S. Jha, W. Lee, B.P. Miller, Formalizing sensitivity in static analysis for intrusion detection, in: Proceedings of IEEE Symposium on Security and Privacy (S & P), Oakland, CA, May 2004.
69. R. Xinwen Fu, Bettati W. Yu, N. Zhang, and W. Zhao Localization attacks to internet threat monitors: modeling and countermeasures IEEE Transactions on Computers 2010
70. J.O. Kephard, S.R. White, Directed-graph epidemiological models of computer virus, in: Proceedings of the 1991 Computer Society Symposium on Research in Security and Privacy (S & P), Oakland, CA, May 1991.
71. J.O. Kephart, S.R. White, Measuring and modeling computer virus prevalence, in: Proceedings of the 14th IEEE Symposium on Security and Privacy (S & P), Oakland, CA, May 1993.
72. M. Garetto, W B. Gong, D. Towsley, Modeling malware spreading dynamics, in: Proceedings of the IEEE Conference on Computer Communications (INFOCOM), San Francisco, CA, March 2003.
73. C.S. Chen, C.Y. Ji, A self-learning worm using importance scanning, in: Proceedings of the 1th ACM CCS Workshop on Rapid Malcode (WORM), Fairfax, VA, November 2005.
74. N. Provos, J. McClain, K. Wang, Search worms, in: Proceedings of the 1th ACM CCS Workshop on Rapid Malcode (WORM), Fairfax, VA, November 2006.
75. J. Ma, G.M. Voelker, S. Savage, Self-stopping worms, in: Proceedings of the ACM Workshop on Rapid Malcode (WORM), Fairfax, VA, November 2005.
76. C. Cowan, C. Pu, D. Maier, H. Hinton, P. Bakke, S. Beattie, A. Grier, P. Wagle, Q. Zhang, Stack-guard: Automatic adaptive detection and prevention of buffer-overflow attacks, in: Proceedings of 7th USENIX Security Symposium (SECURITY), San Antonio, TX, August 1998.
77. A. Lakhina, M. Crovella, C. Diot, Mining anomalies using traffic feature distribution, in: Proceedings of ACM SIGCOMM, Philadelphia, PA, August 2005.
78. R. Perdisci, O. Kolesnikov, P. Fogla, M. Sharif, and W. Lee Polymorphic blending attacks Proceedings of the 15th USENIX Security Symposium (SECURITY) 2006 Vancouver B.C.
79. C.C. Zou, W. Gong, D. Towsley, Worm propagation modeling and analysis under dynamic quarantine defense, in: Proceedings of the 1th ACM CCS Workshop on Rapid Malcode (WORM), Washington DC, October 2003.
80. S. Staniford Containment of scanning worms in enterprise networks Journal of Computer Security 2003
81. J. Twucrpss, M.M. Williamson, Implementing and testing a virus throttling, in: Proceedings of the 12th USENIX Security Symposium (SECURITY), Washington, DC, August 2003.
82. S.G. Chen, Y Tang, Slowing down internet worms, in: Proceeding of the 24th International Conference on Distributed Computing Systems (ICDCS), Tokyo, Japan, March 2004.
83. Trend Micro, .
84. Ram Dantu, Joo Cangussu, Arun Yelimeli, Fast worm containment using feedback control, in: Proceedings of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), Berlin, Germany, July 2006.
85. C.C. Zou, D. Towsley, W. Gong, A firewall network system for worm defense in enterprise networks, Umass ECE Technical Report TR-04-CSE-01, 2004.
86. T.M. Cover, and J.A. Thomas Elements of Information Theory 1991 Wiley Series