Abstract:Internet worm infection continues to be one of top security threats and has been widely used by botnets to recruit new bots. In this work, we attempt to quantify the infection ability of individual hosts and reveal the key characteristics of the underlying topology formed by worm infection, i.e., the number of children and the generation of the worm infection family tree. Specifically, we first apply probabilistic modeling methods and a sequential growth model to analyze the infection tree of a wide class of worms. We analytically and empirically find that the number of children has asymptotically a geometric distribution with parameter 0.5. As a result, on average half of infected hosts never compromise any vulnerable host, over 98% of infected hosts have no more than five children, and a small portion of infected hosts have a large number of children. We also discover that the generation follows closely a Poisson distribution and the average path length of the worm infection family tree increases approximately logarithmically with the total number of infected hosts. Next, we empirically study the infection structure of localized-scanning worms and surprisingly find that most of the above observations also apply to localized-scanning worms. Finally, we apply our findings to develop bot detection methods and study potential countermeasures for a botnet (e.g., Conficker C) that uses scan-based peer discovery to form a P2P-based botnet. Specifically, we demonstrate that targeted detection that focuses on the nodes with the largest number of children is an efficient way to expose bots. For example, our simulation shows that when 3.125% nodes are examined, targeted detection can reveal 22.36% bots. However, we also point out that future botnets may limit the maximum number of children to weaken targeted detection, without greatly slowing down the speed of worm infection.

Study on Event-Sequence Based Worm Behavior Analysis in Internet

Analysis Algorithm for the Worm Network Behavior Based on Event Sequence

Worm Intrusion Alarm Modeling Based on Network Traffic Character

Research of Characteristics of Worm Traffic

Research and Development of Worm Detection Technologies

Detection Method of Computer Worms Based on SVM

Worm traffic modeling for network performance analysis

Cooperation System of Worm Detection and Quarantine in Real Time

Detecting Randomly Scanning Worms Based on Heavy-Tailed Property

The multi-fractal nature of worm and normal traffic at individual source level

Design and Implementation of Network Worm Detection System for Internal Network

Correlation based analysis of spreading Codered worms

Detection Algorithm of Internet Worm Eruption and Its Application

Research of Internet Worm Infection Probability Estimation Based on Comprehensive Analysis of Net-Flow and Packets

Worm detection technology research of net-flow dynamic critical line established based on statistical analytic method

Characterizing Internet Worm Infection Structure

A Fast Method of Signature Generation for Polymorphic Worms

Comprehensive analysis of a stochastic wireless sensor network motivated by Black-Karasinski process

Darknet-Based Inference of Internet Worm Temporal Characteristics

Analysis of Abnormalities of Worm Traffic for Obtaining Worm Detection Vectors

An Investigation on Instant Messaging Worm Based on Complex Network Theory