Issue No.10 - October (2010 vol.21)
Nan Zhang , George Washington University, Washington DC
Xinwen Fu , University of Massachusetts Lowell, Lowell
Wei Zhao , University of Macau, Taipa Macau
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/TPDS.2009.161
In this paper, we address issues related to the modeling, analysis, and countermeasures of worm attacks on the Internet. Most previous work assumed that a worm always propagates itself at the highest possible speed. Some newly developed worms (e.g., “Atak” worm) contradict this assumption by deliberately reducing the propagation speed in order to avoid detection. As such, we study a new class of worms, referred to as self-disciplinary worms. These worms adapt their propagation patterns in order to reduce the probability of detection, and eventually, to infect more computers. We demonstrate that existing worm detection schemes based on traffic volume and variance cannot effectively defend against these self-disciplinary worms. To develop proper countermeasures, we introduce a game-theoretic formulation to model the interaction between the worm propagator and the defender. We show that an effective integration of multiple countermeasure schemes (e.g., worm detection and forensics analysis) is critical for defending against self-disciplinary worms. We propose different integrated schemes for fighting different self-disciplinary worms, and evaluate their performance via real-world traffic data.
Worm, game theory, anomaly detection.
Nan Zhang, Xinwen Fu, Wei Zhao, "Self-Disciplinary Worms and Countermeasures: Modeling and Analysis", IEEE Transactions on Parallel & Distributed Systems, vol.21, no. 10, pp. 1501-1514, October 2010, doi:10.1109/TPDS.2009.161