Exact Modeling of Propagation for Permutation-Scanning Worms Parbati Kumar Manna, Shigang Chen, Sanjay Ranka INFOCOM’08

Exact Modeling of Propagation for Permutation-Scanning Worms

Parbati Kumar Manna, Shigang Chen, Sanjay Ranka

INFOCOM’08

2008/11/19 Speaker: Li-Ming Chen 2

Virus/Worm: A Brief History1969 APARNET (forerunner of the Internet)

1979 Engineers at Xerox Research Center discover the computer worm

1983 Fred Cohen – Computer Virus

1988 Robert Morris: unleashes a worm that invades ARPANET computers

1995 Microsoft release Windows 95 (and macro virus appears)

1992 Toolkits, mutation engine

1999 Melissa virus

2000 “I Love You” virus, DoS, DDoS

2001 CodeRed I, II, Nimda

2003 Slammer (fastest-spreading), Blaster

2004 Sasser


History of Worm Propagation Modeling

1999

2002

2001

2003

2004

“Directed-graph epidemiological models of computer virus”

CodeRed I, II, Nimda

Simple epidemic model (considering scanning rate) Modeling CodeRed propagation (how about network congestion/human countermeasures?)

Modeling propagation w/ the idea of “hitlist”, “death rate”, “patching rate”…

Study the top speed of flash worm

2005 Self-stopping worm

2006 Worus (Worm + Virus)

2008 Permutation-scanning worms


Why Modeling Worm Propagation? Simulation

Pros Cons Limitation?

Modeling Pros Cons Limitation?


Outline

Permutation-scanning (basis) A 0-jump Worm Model (extension) The k-jump Worm Model Usage of the Analytical Model Conclusion and comments


Permutation-scanning Worms Traditional: Random-scanning worms Permutation-scanning:

Divide-and-Conquer Jumping:

Avoid being detected: Virtual permutation address space

Fast vs. Stealthy the big name vs. nearly no network footprints?


Scanzone

(Def:) A scanzone is the contiguous range of the addresses that are currently being scanned by an active infected host since the last time it jumped. Jump: Old/new infection: k-jump worm:

A special case: 0-jump worm


Example: 0-jump Worm


Example: 0-jump Worm (cont’d)


Classification of Scanning Hosts By judging the effectiveness of scanning of the

active host (ability to generate new infection) Effective (x): Ineffective (y): Nascent (α):


Classification of Scanning Hosts (cont’d)


Modeling a 0-jump Worm

Questions: Q1: Q2: Q3:


Modeling a 0-jump Worm (cont’d)


Ans1: hit ratio


Ans2: old/new infection


Ans3: the effectiveness


Verification of 0-jump Worm Model


Extend to k-jump Worm(see results first :p)


Extend to k-jump Worm

Difference from 0-jump worm: a


Example: State Diagram of a 2-jump Worm


k-jump Worm Model


(Recall) Usage of the Analytical Model Simulation vs. Analytical Model Finding the Truly Independent variables in the

model Effects of parameters on propagation

N V φ r k





Documents

Exact Modeling of Propagation for Permutation-Scanning Worms Parbati Kumar Manna, Shigang Chen, Sanjay Ranka INFOCOM’08