Internet Inferring Worm Temporal Characteristics
Qian Wang1 , Zesheng Chen1 , Kia Makki1 , Niki Pissinou1 , and Chao Chen2 2 Department of Engineering of Electrical & Computer Engineering Florida International University Indiana University - Purdue University Fort Wayne Miami, FL 33174 Fort Wayne, IN 46805 E-mails: {qian.wang, zchen, makkik, pissinou}@fiu.edu E-mail: [e-mail]
1 Department
Abstract-- Internet worm attacks pose a significant threat to network security. In this work, we coin the term Internet worm tomography as inferring the characteristics of Internet worms from the observations of Darknet or network telescopes that are routable but unused IP addresses. Under the framework of Internet worm tomography, we attempt to infer worm temporal behaviors such as the host infection time and the worm infection sequence, and thus pinpoint patient zero. Specifically, we introduce statistical estimation techniques and propose method of moments, maximum likelihood, and linear regression estimators. We show analytically and empirically that our proposed estimators can better infer worm temporal characteristics than a naive estimator that has been used in the previous work.
Counting & Projection
Darknet Observation
Worm Propagation Model
Statistical Model
Measurement Data
Detection & Inference
I. I NTRODUCTION Since Code Red and Nimda worms were released in 2001, epidemic-style attacks have caused enormous damages. Internet worms can spread so rapidly that existing defense systems cannot respond until they have infected most vulnerable hosts. For example, the Slammer worm infected more than 90% of vulnerable machines within 10 minutes on January 25th, 2003 [15]. Therefore, worm attacks present a significant threat to the Internet. To counteract these notorious epidemic-style attacks, many detection and defense strategies have been studied in recent years. According to where the detectors are located, these strategies can generally be classified into three categories: source detection and defense, locating infected hosts in the local networks [17], [11]; middle detection and defense, revealing the appearance of worms by analyzing the traffic going through routers [19], [8], [13]; and destination detection and defense, monitoring unwanted traffic arriving at Darknet or network telescopes, a globally routable address space where no active services or servers reside [1], [2], [3], [4], [5]. There are two types of Darknet: active Darknet that responds to malicious scans to elicit the payloads of the attacks [3], [4], and passive Darknet that observes unwanted traffic passively [2], [5]. In this work, we focus o...
Globecom2008