Modeling the propagation of worms in networks: A survey

IEEE Communications Surveys and Tutorials

Volumn 16, Issue 2, 2014, Pages 942-960

  Wang, Yini ^a   Wen, Sheng ^a   Xiang, Yang ^a   Zhou, Wanlei ^a  

^a DEAKIN UNIVERSITY   (Australia)

Author keywords

Modeling; Network security; Propagation; Worms

Indexed keywords

MODELS; NETWORK SECURITY; SURVEYS; WAVE PROPAGATION;

COMPREHENSIVE ANALYSIS; DEFENSE MECHANISM; DEFENSE STRATEGY; DEFENSE SYSTEM; IN NETWORKS; PROPAGATION MODELS; WORMS;

TOPOLOGY;

EID: 84901195399     PISSN: None     EISSN: 1553877X     Source Type: Journal    
DOI: 10.1109/SURV.2013.100913.00195     Document Type: Article

References (93)

1. D. Moore, C. Shannon et al., "Code-red: a case study on the spread and victims of an internet worm," in Proc. 2nd ACM SIGCOMM Workshop on Internet measurment. ACM, 2002, pp. 273-284. [Online]. Available: http://dl.acm.org/citation.cfm?id=637244
2. H. Berghel, "The code red worm," Commun. of the ACM, vol. 44, no. 12, pp. 15-19, 2001.
3. H. V. Poor, "An introduction to signal detection and estimation," New York, Springer-Verlag, 1988, 559 p., vol. 1, 1988.
4. A. L. Foster, "Colleges brace for the next worm," The Chronicle of Higher Education, vol. 50, no. 28, p. A29, 2004.
5. V. Weafer. (2010) Downadup/conficker and april fools day: One year later. [Online]. Avail-able: http://www.symantec.com/connect/blogs/downadupconficker- and-april-fool-s-day-one-year-later
6. Symantec. ( 2008) W32.downadup (win32/conficker). [Online]. Available: http://www.symantec.com/security-response/writeup.jsp?docid=2008-112203-2408-99
7. (2010) W32.stuxnet, 2010. [Online]. Available: http://www.symantec.com/ security-response/writeup.jsp?docid=2010-071400-3123-99
8. M. Fossi, G. Egan, K. Haley, E. Johnson, T. Mack, T. Adams, J. Blackbird, M. K. Low, D. Mazurek, D. McKinney et al., "Symantec internet security threat report trends for 2010," Volume, vol. 16, p. 20, 2011.
9. J. Hu, X. Yu, D. Qiu, and H.-H. Chen, "A simple and efficient hidden markov model scheme for host-based anomaly intrusion detection," IEEE Network, vol. 23, no. 1, pp. 42-47, 2009. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp?arnumber=4804323
10. S. Staniford, V. Paxson, N. Weaver et al., "How to own the internet in your spare time." in USENIX Security Symp., 2002, pp. 149-167.
11. Z. Chen, L. Gao, and K. Kwiat, "Modeling the spread of active worms," in INFOCOM 2003. 22nd Annu. Joint Conf. IEEE Comput. Commun. IEEE Societies, vol. 3. IEEE, 2003, pp. 1890-1900. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp?arnumber=1209211
12. G. Yan and S. Eidenbenz, "Modeling propagation dynamics of bluetooth worms (extended version)," IEEE Trans. Mobile Computing, vol. 8, no. 3, pp. 353-368, 2009. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all. jsp?arnumber=4624266
13. X. Fan and Y Xiang, "Modeling the propagation of peer-to-peer worms," Future generation computer systems, vol. 26, no. 8, pp. 1433-1443, 2010. [Online]. Available: http://www.sciencedirect.com/science/article/pii/ S0167739X10000737
14. C. C. Zou, D. Towsley, and W. Gong, "Modeling and simulation study of the propagation and defense of internet e-mail worms," IEEE Trans. Dependable and Secure Computing, vol. 4, no. 2, pp. 105-118, 2007. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp?arnumber=4198176
15. H. Andersson and T. Britton, Stochastic epidemic models and their statistical analysis. Springer New York, 2000, vol. 4.
16. Z. Chen and C. Ji, "Importance-scanning worm using vulnerable-host distribution," in IEEE Global Telecommunications Conf, 2005. GLOBECOM'05., vol. 3. IEEE, 2005, pp. 6-pp. [Online]. Available: http://ieeexplore.ieee.org/ xpls/abs-all.jsp?arnumber=1577955
17. "Optimal worm-scanning method using vulnerable-host distributions," Int. J. Secur. Netw., vol. 2, no. 1/2, pp. 71-80, 2007.
18. Z. Chen and C. Chen, "A closed-form expression for static worm-scanning strategies," in IEEE Int. Conf. Commun., 2008. ICC'08. IEEE, 2008, pp. 1573-1577. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs- all.jsp?arnumber=4533340
19. Z. Chen, C. Chen, and C. Ji, "Understanding localized-scanning worms," in IEEE Int. Performance, Computing, and Commun. Conf, 2007. IPCCC 2007. IEEE, 2007, pp. 186-193. [Online]. Available: http://ieeexplore.ieee.org/ xpls/abs-all.jsp?arnumber=4197930 (Pubitemid 350139297)
20. Q. Wang, Z. Chen, C. Chen, and N. Pissinou, "On the robustness of the botnet topology formed by worm infection," in 2010 IEEE Global Telecommunications Conf. (GLOBECOM 2010). IEEE, 2010, pp. 1-6. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp?arnumber=5684002
21. W. Yu, X. Wang, P. Calyam, D. Xuan, and W. Zhao, "On detecting camouflaging worm," in Computer Security Applications Conf, 2006. ACSAC'06. 22nd Annu. IEEE, 2006, pp. 235-244. [Online]. Available: http://ieeexplore. ieee.org/xpls/abs-all.jsp?arnumber=4041170 (Pubitemid 351232918)
22. "Modeling and detection of camouflaging worm," IEEE Trans. Dependable and Secure Computing, vol. 8, no. 3, pp. 377-390, 2011. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp?arnumber=5444887
23. Y Xiang, X. Fan, and W Zhu, "Propagation of active worms: a survey," Int. J. Comput. Systems Science & Engineering, vol. 24, no. 3, pp. 157-172, 2009.
24. X. Fan and Y Xiang, "Defending against the propagation of active worms," The Journal of Supercomputing, vol. 51, no. 2, pp. 167-200, 2010. [Online]. Available: http://link.springer.com/article/10.1007/s11227-009-0283-8
25. T. Yong, L. Jiaqing, X. Bin, and W. Guiyi, "Concept, characteristics and defending mechanism of worms," IEICE TRANS. Information and Systems, vol. 92, no. 5, pp. 799-809, 2009. [Online]. Available: http://search.ieice.org/ bin/summary.php?id=e92-d-5-799
26. P. Li, M. Salour, and X. Su, "A survey of internet worm detection and containment," IEEE Commun. Surveys & Tutorials, vol. 10, no. 1, pp. 20-35, 2008. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp? arnumber=4483668
27. N. Weaver, V. Paxson, S. Staniford, and R. Cunningham, "A taxonomy of computer worms," in Proc. 2003 ACM workshop on Rapid malcode. ACM, 2003, pp. 11-18. [Online]. Available: http://dl.acm.org/citation.cfm?id=948190 (Pubitemid 40681805)
28. E. Levy, "Worm propagation and generic attacks," IEEE Security & Privacy, vol. 3, no. 2, pp. 63-65, 2005. [Online]. Available: http://ieeexplore.ieee. org/xpls/abs-all.jsp?arnumber=1423964 (Pubitemid 40542064)
29. C. Shannon and D. Moore, "The spread of the witty worm," IEEE Security & Privacy, vol. 2, no. 4, pp. 46-50, 2004. [Online]. Available: http://ieeexplore.ieee. org/xpls/abs-all.jsp?arnumber=1324598
30. Symantec. (2004) W32.sasser.worm. [Online]. Available: http://www.symantec.com/security-response/writeup.jsp?docid=2004-050116-1831-99.
31. D. M. Kienzle and M. C. Elder, "Recent worms: a survey and trends," in Proc. 2003 ACM workshop on Rapid malcode. ACM, 2003, pp. 1-10. [Online]. Available: http://dl.acm.org/citation.cfm?id=948189 (Pubitemid 40681804)
32. F-Secure. (2011) Love letter virus. [Online]. Available: http://www.f-secure.com/v-descs/love.shtml.
33. Iloveyou virus lessons learned report. Army Forces Command. [Online]. Available: http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA415104&Location= U2&doc=GetTRDoc.pdf
34. Symantec. (2001) W32.sircam.worm. [Online]. Available: http://www.symantec.com/security-response/writeup.jsp?docid=2001-071720-1640- 99&tabid=2
35. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver, "Inside the slammer worm," IEEE Security & Privacy, vol. 1, no. 4, pp. 33-39, 2003. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all. jsp?arnumber=1219056
36. ( 2001) Advisories and alerts: ida code red worm. eEye Digital Security. [Online]. Available: http://www.eeye.com/html/Research/Advisories/AL20010717. html.
37. C. C. Zou, D. Towsley, and W. Gong, "On the performance of internet worm scanning strategies," Performance Evaluation, vol. 63, no. 7, pp. 700-723, 2006. [Online]. Available: http://www.sciencedirect.com/science/ article/pii/S0166531605001112
38. C. C. Zou, D. Towsley, W. Gong, and S. Cai, "Routing worm: A fast, selective attack worm based on ip address information," in Proc. 19th Workshop on Principles of Advanced and Distributed Simulation. IEEE Computer Society, 2005, pp. 199-206. [Online]. Available: http://dl.acm.org/citation.cfm? id=1070175 (Pubitemid 41451138)
39. C. C. Zou, W Gong, and D. Towsley, "Code red worm propagation modeling and analysis," in Proc. 9th ACM conference on Computer and communications security. ACM, 2002, pp. 138-147. [Online]. Available: http://dl.acm.org/citation.cfm?id=586130
40. K. R. Rohloff and T. Basar, "Stochastic behavior of random constant scanning worms," in Comput. Commun. Netw., 2005. ICCCN 2005. Proc. 14th Int. Conf. IEEE, 2005, pp. 339-344. [Online]. Available: http://ieeexplore.ieee. org/xpls/abs-all.jsp?arnumber=1523881 (Pubitemid 44335336)
41. S. H. Sellke, N. B. Shroff, and S. Bagchi, "Modeling and automated containment of worms," IEEE Trans. Dependable and Secure Computing, vol. 5, no. 2, pp. 71-86, 2008. [Online]. Available: http://ieeexplore.ieee. org/xpls/abs-all.jsp?arnumber=4358715 (Pubitemid 351681550)
42. Y Wang, S. Wen, S. Cesare, W Zhou, and Y Xiang, "The microcosmic model of worm propagation," The Computer Journal, vol. 54, no. 10, pp. 1700-1720, 2011. [Online]. Available: http://comjnl.oxfordjournals.org/content/ 54/10/1700.short
43. ( 2001) blaster worm analysis. eEye Digital Security. [Online]. Available: http://www.eeye.com/html/Research/Advisories/AL20030811.html
44. N. Weaver, "A brief history of the worm," Security Focus Online, vol. 26, 2001.
45. R. W. Thommes and M. Coates, "Epidemiological modelling of peer-to-peer viruses and pollution." in INFOCOM, vol. 6, 2006, pp. 1-12.
46. W. Fan and K. Yeung, "Online social networksparadise of computer viruses," Physica A: Statistical Mechanics and its Applications, vol. 390, no. 2, pp. 189-197, 2011. [Online]. Available: http://www.sciencedirect.com/ science/article/pii/S0378437110008344
47. W32.koobface. [Online]. Available: http://www.symantec.com/security- response/writeup.jsp?docid=2008-080315-0217-99.
48. P. Erdos and A. Rényi, "On the evolution of random graphs," Publ. Math. Inst. Hungar. Acad. Sci, vol. 5, pp. 17-61, 1960.
49. H. Ebel, L.-I. Mielsch, and S. Bornholdt, "Scale-free topology of e-mail networks," arXiv preprint cond-mat/0201476, 2002. [Online]. Available: http://arxiv.org/abs/cond-mat/0201476
50. M. Boguná, R. Pastor-Satorras, and A. Vespignani, "Epidemic spreading in complex networks with degree correlations," Statistical Mechanics of Complex Networks-Lectures Notes in Physics, vol. 625, 2003.
51. A. Mislove, M. Marcon, K. P. Gummadi, P. Druschel, and B. Bhattacharjee, "Measurement and analysis of online social networks," in Proc. 7th ACM SIGCOMM conf. Internet measurement. ACM, 2007, pp. 29-42. [Online]. Available: http://dl.acm.org/citation.cfm?id=1298311
52. A. Vazquez, B. Racz, A. Lukacs, and A.-L. Barabasi, "Impact of non-poissonian activity patterns on spreading processes," Physical review letters, vol. 98, no. 15, p. 158702, 2007. [Online]. Available: http://prl.aps.org/abstract/PRL/v98/i15/e158702
53. J. Kleinberg and R. Rubinfeld, "Short paths in expander graphs," in Foundations of Computer Science, 1996. Proc, 37th Annu. Symp. IEEE, 1996, pp. 86-95. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs- all.jsp?arnumber=548467
54. M. Molloy and B. Reed, "A critical point for random graphs with a given degree sequence," Random structures & algorithms, vol. 6, no. 2-3, pp. 161-180, 1995. [Online]. Available: http://onlinelibrary.wiley.com/doi/ 10.1002/rsa.3240060204/full
55. "The size of the giant component of a random graph with a given degree sequence," Combinatorics probability and computing, vol. 7, no. 3, pp. 295-305, 1998. [Online]. Available: http://journals.cambridge.org/ production/action/cjoGetFulltext?fulltextid =46636 (Pubitemid 128480814)
56. D. J. Watts and S. H. Strogatz, "Collective dynamics of small-worldnetworks," nature, vol. 393, no. 6684, pp. 440-442, 1998. [Online]. Available: http://www.nature.com/nature/journal/v393/n6684/abs/ 393440a0.html
57. G. Yan, G. Chen, S. Eidenbenz, and N. Li, "Malware propagation in online social networks: nature, dynamics, and defense implications," in Proc. 6th ACM Symposium on Information, Computer and Communications Security. ACM, 2011, pp. 196-206. [Online]. Available: http://dl.acm.org/citation.cfm?id= 1966939
58. N. Li and G. Chen, "Analysis of a location-based social network," in Computational Science and Engineering, 2009. CSE'09. Int. Conf, vol. 4. IEEE, 2009, pp. 263-270. [Online]. Available: http://ieeexplore. ieee.org/xpls/abs-all.jsp?arnumber=5284112
59. M. Jovanovic, F. Annexstein, and K. Berman, "Modeling peer-to-peer network topologies through small-world models and power laws," in IX Telecommunications Forum, TELFOR, 2001, pp. 1-4.
60. L. Adamic, O. Buyukkokten, and E. Adar, "A social network caught in the web," First Monday, vol. 8, no. 6, 2003. [Online]. Available: http://ojs-prod-lib.cc.uic.edu/ojs/index.php/fm/article/view/1057
61. R. Kumar, J. Novak, and A. Tomkins, "Structure and evolution of online social networks," in Link Mining: Models, Algorithms, and Applications. Springer, 2010, pp. 337-357. [Online]. Available: http://link.springer.com/chapter/10.1007/978-1-4419-6515-8-13
62. Y.-Y. Ahn, S. Han, H. Kwak, S. Moon, and H. Jeong, "Analysis of topological characteristics of huge online social networking services," in Proc. 16th int. conf. on World Wide Web. ACM, 2007, pp. 835-844. [Online]. Available: http://dl.acm.org/citation.cfm?id=1242685 (Pubitemid 47582313)
63. Y Li, W. Chen, Y Wang, and Z.-L. Zhang, "Influence diffusion dynamics and influence maximization in social networks with friend and foe relationships," in Proc. 6th ACM int. conf. on Web search and data mining. ACM, 2013, pp. 657-666. [Online]. Available: http://dl.acm.org/citation.cfm?id= 2433478
64. Y Li, B. Q. Zhao, and J. Lui, "On modeling product advertisement in large-scale online social networks," IEEE/ACM Trans. Netw. (TON), vol. 20, no. 5, pp. 1412-1425, 2012. [Online]. Available: http://dl.acm.org/citation.cfm? id=2428703
65. V. Braitenberg and A. Schüz, Anatomy of the cortex: Statistics and geometry. Springer-Verlag Publishing, 1991.
66. R. Kumar, P. Raghavan, S. Rajagopalan, and A. Tomkins, "Trawling the web for emerging cyber-communities," Computer networks, vol. 31, no. 11, pp. 1481-1493, 1999. [Online]. Available: http://www.sciencedirect.com/science/ article/pii/S1389128699000407
67. A.-L. Barabási and R. Albert, "Emergence of scaling in random networks," science, vol. 286, no. 5439, pp. 509-512, 1999. [Online]. Available: http://www.sciencemag.org/content/286/5439/509.short
68. Z. Chen and C. Ji, "Spatial-temporal modeling of malware propagation in networks," IEEE Trans. Neural Netw., vol. 16, no. 5, pp. 1291-1303, 2005. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp?arnumber= 1510727 (Pubitemid 41444629)
69. S. Wen, W. Zhou, Y Wang, W Zhou, and Y Xiang, "Locating defense positions for thwarting the propagation of topological worms," IEEE Commun. Lett., vol. 16, no. 4, pp. 560-563, 2012. [Online]. Available: http://ieeexplore.ieee. org/xpls/abs-all.jsp?arnumber=6168149
70. D. Moore and C. Shannon, "Caida: The nyxem email virus: analysis and inferences," 2004.
71. S. Wen, W Zhou, J. Zhang, Y Xiang, and W. Jia, "Modeling propagation dynamics of social network worms," IEEE Trans. Parallel Distrib. Syst., 2012. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp?arnumber= 6287505
72. Y Moreno, R. Pastor-Satorras, and A. Vespignani, "Epidemic outbreaks in complex heterogeneous networks," The European Physical Journal B-Condensed Matter and Complex Systems, vol. 26, no. 4, pp. 521-529, 2002. [Online]. Available: http://link. springer.com/article/10.1140/epjb/e20020122 (Pubitemid 135698247)
73. C. Gao, J. Liu, and N. Zhong, "Network immunization and virus propagation in email networks: experimental evaluation and analysis," Knowledge and information systems, vol. 27, no. 2, pp. 253-279, 2011. [Online]. Available: http://link.springer.com/article/10.1007/s10115-010-0321-0
74. B. Rozenberg, E. Gudes, and Y Elovici, "Sisr-a new model for epidemic spreading of electronic threats," in Information Security. Springer, 2009, pp. 242-249. [Online]. Available: http://link.springer.com/ chapter/10.1007/978-3-642-04474-8-20
75. Y Wang, S. Wen, S. Cesare, W. Zhou, and Y Xiang, "Eliminating errors in worm propagation models," IEEE Commun. Lett., vol. 15, no. 9, pp. 1022-1024, 2011. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all. jsp?arnumber=5958564
76. P. Mahadevan, D. Krioukov, K. Fall, and A. Vahdat, "Systematic topology analysis and generation using degree correlations," ACM SIGCOMM Comput. Commun. Review, vol. 36, no. 4, pp. 135-146, 2006. [Online]. Available: http://dl.acm.org/citation.cfm?id=1159930 (Pubitemid 44623722)
77. D. Chakrabarti, J. Leskovec, C. Faloutsos, S. Madden, C. Guestrin, and M. Faloutsos, "Information survival threshold in sensor and p2p networks," in INFOCOM 2007. 26th IEEE Int. Conf. Comput. Commun. IEEE, 2007, pp. 1316-1324. [Online]. Available: http://ieeexplore.ieee. org/xpls/abs-all.jsp?arnumber=4215738 (Pubitemid 47334356)
78. M. Roberts and J. Heesterbeek, "Mathematical models in epidemiology," Mathematical models, 2003.
79. R. Pastor-Satorras and A. Vespignani, "Epidemic spreading in scale-free networks," Physical review letters, vol. 86, no. 14, p. 3200, 2001. [Online]. Available: http://prl.aps.org/abstract/PRL/v86/i14/p3200-1
80. Y Moreno, J. B. Gomez, and A. F. Pacheco, "Epidemic incidence in correlated complex networks," Physical Review E, vol. 68, no. 3, p. 035103, 2003. [Online]. Available: http://pre.aps.org/abstract/PRE/v68/i3/e035103
81. D. Moore, "Caida analysis of code-red," The Cooperate Association for Internet Data Analysis, 2001.
82. D. Moore and C. Shannon, "The spread of the code-red worm (crv2)," 2001.
83. D. J. Daley, J. Gani, and J. J. M. Gani, Epidemic modelling: an introduction. Cambridge University Press, 2001, vol. 15.
84. R. M. Anderson, R. M. May, and B. Anderson, Infectious diseases of humans: dynamics and control. Wiley Online Library, 1992, vol. 28.
85. N. T. Bailey et al., The mathematical theory of infectious diseases and its applications. Charles Griffin & Company Ltd, 5a Crendon Street, High Wycombe, Bucks HP13 6LE., 1975.
86. J. Wu, S. Vangala, L. Gao, and K. A. Kwiat, "An effective architecture and algorithm for detecting worms with various scan." in NDSS, 2004.
87. C. Wang, J. C. Knight, and M. C. Elder, "On computer viral infection and the effect of immunization," in Computer Security Applications, 2000. ACSAC'00. 16th Annu. Conf. IEEE, 2000, pp. 246-256. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp?arnumber=898879
88. S. Xing and B.-P. Paris, "Measuring the size of the internet via importance sampling," IEEE J. Sel. Areas Commun., vol. 21, no. 6, pp. 922-933, 2003. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp? arnumber=1217278
89. D. Dagon, C. C. Zou, and W. Lee, "Modeling botnet propagation using time zones." in NDSS, vol. 6, 2006, pp. 2-13.
90. S. Biedermann and S. Katzenbeisser, "Detecting computer worms in the cloud," in Open Problems in Network Security. Springer, 2012, pp. 43-54. [Online]. Available: http://link.springer.com/chapter/10.1007/978-3-642-27585-2- 4
91. T. Garfinkel and M. Rosenblum, "When virtual is harder than real: Security challenges in virtual machine based computing environments." in HotOS, 2005.
92. C. Gao and J. Liu, "Modeling and restraining mobile virus propagation," IEEE Trans. Mob. Compu, 2013. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp?arnumber=6138859
93. Y. Wang, D. Chakrabarti, C. Wang, and C. Faloutsos, "Epidemic spreading in real networks: An eigenvalue viewpoint," in Reliable Distributed Systems, 2003. Proc. 22nd Int. Symp. IEEE, 2003, pp. 25-34. [Online]. Available: http://ieeexplore.ieee.org/xpls/abs-all.jsp?arnumber= 1238052 (Pubitemid 41554102)