Issue No. 02 - April-June (2008 vol. 5)
Self-propagating codes, called worms, such as Code Red, Nimda, and Slammer, have drawn significant attention due to their enormously adverse impact on the Internet. Thus, there is great interest in the research community in modeling the spread of worms and in providing adequate defense mechanisms against them. In this paper, we present a (stochastic) branching process model for characterizing the propagation of Internet worms. The model is developed for uniform scanning worms and then extended to preference scanning worms. This model leads to the development of an automatic worm containment strategy that prevents the spread of a worm beyond its early stage. Specifically, for uniform scanning worms, we are able to (1) provide a precise condition that determines whether the worm spread will eventually stop and (2) obtain the distribution of the total number of hosts that the worm infects. We then extend our results to contain preference scanning worms. Our strategy is based on limiting the number of scans to dark-address space. The limiting value is determined by our analysis. Our automatic worm containment scheme effectively contains both uniform scanning worms and local preference scanning worms, and it is validated through simulations and real trace data to be non-intrusive. We also show how to incrementally deploy our worm containment strategy.
(viruses, worms, Trojan horses), (Internet scanning worms), (stochastic worm modeling), (branching process model), (preference scanning worms), (automatic worm containment).
S. Bagchi, S. H. Sellke and N. B. Shroff, "Modeling and Automated Containment of Worms," in IEEE Transactions on Dependable and Secure Computing, vol. 5, no. , pp. 71-86, 2007.