Abstract
There have been many studies on modeling the propagation patterns of Internet worms since the advent of Morris worm. Among them, there is a well defined propagation model, which is generally called random constant spread (RCS) model. However, there are some limitations to model the propagation patterns of new emergent Internet worms with the RCS model because the model uses the only number of infected hosts as the factor of a worm’s propagation. The new worms have several considerable characteristics: utilization of a faster scanning strategy, miniaturization of the size of a worm’s propagation packet, denial of service by network saturation, and maximum damage before human-mediated responses. These characteristics make it difficult to notice much harder than before whether a worm propagates itself or not. Therefore, a basic factor instead of the number of infected hosts, which is used by the RCS model, is required to model the propagation patterns of new worms. In this paper, only analysis and simulation results based on usage rate of network bandwidth, which can be considered as a basic factor, are presented about the propagation pattern of a worm with random scanning strategy. Miniaturization of the size of a propagation packet and utilization of a faster scanning strategy are related to the size of worm’s propagation packet and its propagation rate, respectively. It is presented that the latter is more sensitive than the former.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Morris worm, http://en.wikipedia.org/wiki/Morris_worm
Bailey, N.T.J.: The Mathematical Theory of Epidemics, New York, Hafner (1957)
Hethcote, H.W.: The Mathematics of Infectious Diseases. SIAM Review 42(4), 599–653 (2000)
Moore, D., Shannon, C., Voelker, G.M., Savage, S.: Internet Quarantine: Requirements for Containing Self-Propagating Code. In: Proc. of IEEE INFOCOM 2003 Conference, IEEE Press, Los Alamitos (2003)
Staniford, S., Paxson, V., Weaver, N.: How to Own the Internet in Your Spare Time. In: Proc. of the 11th USENIX Security Symposium, pp. 149–167 (2002)
Kienzle, D.M., Elder, M.C.: Recent worms: a survey and trends. In: Proc. of the 2003 ACM Workshop on Rapid Malcode, pp. 1–10 (2003)
Qing, S., Wen, W.: A survey and trends on Internet worms. In: Computers & Security, vol. 24, pp. 334–346. Elsevier Ltd., Amsterdam (2005)
Zou, C.C., Towsley, D., Gong, W., Cai, S.: Advanced Routing Worm and Its Security Challenges. Simulation 82(1), 75–85 (2006)
Zou, C.C., Towsley, D., Gong, W.: Modeling and Simulation Study of the Propagation and Defense of Internet Email Worm. IEEE Transactions on Dependable and Secure Computing 4(2), 105–118 (2007)
Provos, N., McClain, J., Wang, K.: Search Worms. In: Proc. of the 4th ACM Workshop on Recurring Malcode, pp. 1–8 (2006)
Kargl, F., Maier, J., Weber, M.: Protecting Web Servers from Distributed Denial of Service Attacks. In: Proc. of the 10th international conference on World Wide Web, pp. 514–524 (2001)
Zou, C.C., Gong, W., Towsley, D., Gao, L.: The monitoring and early detection of internet worms. IEEE/ACM Transactions on Networking (TON) 13(5), 961–974 (2005)
Weaver, N.C.: Warhol Worms: The Potential for Very Fast Internet Plagues, http://www.iwar.org.uk/comsec/resources/worms/warhol-worm.htm
Moore, D., Shannon, C.: Code-Red: a Case Study on the Spread and Victims of an Internet Worm. In: Proc. of the 2002 ACM SIGCOMM Internet Measurement Workshop, Marseille, France, pp. 273–284 (2002)
Frauenthal, J.C.: Mathematical Modeling in Epidemiology. Springer, New York (1980)
Zou, C.C., Gong, W., Towsley, D.: Code Red Worm Propagation Modeling and Analysis. In: Proc. of CCS 2002 (2002)
CAIDA (Cooperative Association for Internet Data Analysis), http://www.caida.org
Zou, C.C., Gao, L., Gong, W., Towsley, D.: Monitoring and early warning for Internet worms. In: Proc. of 10th ACM Conf. Comput. Commun. Security, Washington, DC (2003)
Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: Inside the Slammer Worm. IEEE Security & Privacy 1(4) (2003)
IANA (Internet Assigned Numbers Authority), http://www.iana.org
The network simulator: NS-2, http://www.isi.edu/nsnam/ns
The MathWorks, http://www.mathworks.com
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2010 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Ko, K.S., Jang, H., Park, B.W., Eom, Y.I. (2010). Analysis of the Propagation Pattern of a Worm with Random Scanning Strategy Based on Usage Rate of Network Bandwidth. In: Lee, D., Hong, S. (eds) Information, Security and Cryptology – ICISC 2009. ICISC 2009. Lecture Notes in Computer Science, vol 5984. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-14423-3_25
Download citation
DOI: https://doi.org/10.1007/978-3-642-14423-3_25
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-14422-6
Online ISBN: 978-3-642-14423-3
eBook Packages: Computer ScienceComputer Science (R0)