NDLI: Modeling and Automated Containment of Worms

Please wait, while we are loading the content...

Modeling and Automated Containment of Worms

Content Provider	IEEE Xplore Digital Library
Author	Sellke, S.H. Shroff, N.B. Bagchi, S.
Copyright Year	2004
Abstract	Self-propagating codes, called worms, such as Code Red, Nimda, and Slammer, have drawn significant attention due to their enormously adverse impact on the Internet. Thus, there is great interest in the research community in modeling the spread of worms and in providing adequate defense mechanisms against them. In this paper, we present a (stochastic) branching process model for characterizing the propagation of Internet worms. The model is developed for uniform scanning worms and then extended to preference scanning worms. This model leads to the development of an automatic worm containment strategy that prevents the spread of a worm beyond its early stage. Specifically, for uniform scanning worms, we are able to 1) provide a precise condition that determines whether the worm spread will eventually stop and 2) obtain the distribution of the total number of hosts that the worm infects. We then extend our results to contain preference scanning worms. Our strategy is based on limiting the number of scans to dark-address space. The limiting value is determined by our analysis. Our automatic worm containment schemes effectively contain both uniform scanning worms and local preference scanning worms, and it is validated through simulations and real trace data to be nonintrusive. We also show that our worm strategy, when used with traditional firewalls, can be deployed incrementally to provide worm containment for the local network and benefit the Internet.
Sponsorship	IEEE Computer Society
Starting Page	71
Ending Page	86
Page Count	16
File Size	3069414
File Format	PDF
ISSN	15455971
Volume Number	5
Issue Number	2
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2008-04-01
Publisher Place	U.S.A.
Access Restriction	One Nation One Subscription (ONOS)
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Computer worms Internet Stochastic processes IP networks Humans Computer viruses Telecommunication traffic Equipment failure Buffer overflow (automatic worm containment). (viruses worms Trojan horses) (Internet scanning worms) (stochastic worm modeling) (branching process model) (preference scanning worms)
Content Type	Text
Resource Type	Article
Subject	Computer Science Electrical and Electronic Engineering

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Malcode mysteries revealed [computer viruses and worms]

The spread of the Witty worm

WormShield: Fast Worm Signature Generation with Distributed Fingerprint Aggregation

The monitoring and early detection of Internet worms

Thwarting Zero-Day Polymorphic Worms With Network-Level Length-Based Signature Generation

The Blaster worm: then and now

Long-range dependence ten years of Internet traffic modeling

Tracing Worm Break-In and Contaminations via Process Coloring: A Provenance-Preserving Approach

Modeling and Simulation Study of the Propagation and Defense of Internet E-mail Worms

Modeling and Automated Containment of Worms

Similar Documents

Malcode mysteries revealed [computer viruses and worms]

The spread of the Witty worm

WormShield: Fast Worm Signature Generation with Distributed Fingerprint Aggregation

The monitoring and early detection of Internet worms

Thwarting Zero-Day Polymorphic Worms With Network-Level Length-Based Signature Generation

The Blaster worm: then and now

Long-range dependence ten years of Internet traffic modeling

Tracing Worm Break-In and Contaminations via Process Coloring: A Provenance-Preserving Approach

Modeling and Simulation Study of the Propagation and Defense of Internet E-mail Worms

Modeling and Automated Containment of Worms