NDLI: An Information-Theoretic View of Network-Aware Malware Attacks

Content Provider	IEEE Xplore Digital Library
Author	Zesheng Chen Chuanyi Ji
Copyright Year	2005
Abstract	This work provides an information-theoretic view to better understand the relationships between aggregated vulnerability information viewed by attackers and a class of randomized epidemic scanning algorithms. In particular, this work investigates three aspects: 1) a network vulnerability as the nonuniform vulnerable-host distribution, 2) threats, i.e., intelligent malwares that exploit such a vulnerability, and 3) defense, i.e., challenges for fighting the threats. We first study five large data sets and observe consistent clustered vulnerable-host distributions. We then present a new metric, referred to as the nonuniformity factor, that quantifies the unevenness of a vulnerable-host distribution. This metric is essentially the Renyi information entropy that unifies the nonuniformity of a vulnerable-host distribution with different malware-scanning methods. Next, we draw a relationship between Renyi entropies and randomized epidemic scanning algorithms. We find that the infection rates of malware-scanning methods are characterized by the Renyi entropies that relate to the information bits in a nonunform vulnerable-host distribution extracted by a randomized scanning algorithm. Meanwhile, we show that a representative network-aware malware can increase the spreading speed by exactly or nearly a nonuniformity factor when compared to a random-scanning malware at an early stage of malware propagation. This quantifies that how much more rapidly the Internet can be infected at the early stage when a malware exploits an uneven vulnerable-host distribution as a network-wide vulnerability. Furthermore, we analyze the effectiveness of defense strategies on the spread of network-aware malwares. Our results demonstrate that counteracting network-aware malwares is a significant challenge for the strategies that include host-based defenses and IPv6.
Sponsorship	IEEE Signal Processing Society
Starting Page	530
Ending Page	541
Page Count	12
File Size	839906
File Format	PDF
ISSN	15566013
Volume Number	4
Issue Number	3
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2009-09-01
Publisher Place	U.S.A.
Access Restriction	One Nation One Subscription (ONOS)
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Computer worms Intelligent networks Clustering algorithms Information entropy Data mining IP networks Measurement Computer viruses Monitoring Social network services performance metrics Attack models network security
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Safety, Risk, Reliability and Quality

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Low-Rate DDoS Attacks Detection and Traceback by Using New Information Metrics

Issues in high-speed Internet security

An Information-Theoretical View of Network-Aware Malware Attacks

Knowledge-independent traffic monitoring: Unsupervised detection of network attacks

Attack Pattern Discovery in Forensic Investigation of Network Attacks

Entropy Based Adaptive Flow Aggregation

Security Issues in Online Social Networks

Stealing Reality: When Criminals Become Data Scientists (or Vice Versa)

Learning from information security history

An Information-Theoretic View of Network-Aware Malware Attacks

Similar Documents

Low-Rate DDoS Attacks Detection and Traceback by Using New Information Metrics

Issues in high-speed Internet security

An Information-Theoretical View of Network-Aware Malware Attacks

Knowledge-independent traffic monitoring: Unsupervised detection of network attacks

Attack Pattern Discovery in Forensic Investigation of Network Attacks

Entropy Based Adaptive Flow Aggregation

Security Issues in Online Social Networks

Stealing Reality: When Criminals Become Data Scientists (or Vice Versa)

Learning from information security history

An Information-Theoretic View of Network-Aware Malware Attacks