Code red worm propagation modeling and analysis

Zou, Cliff C.; Gong, Weibo; Towsley, D.

doi:10.1145/586127.586130

Cited by 196 publications

(276 citation statements)

References 7 publications

Supporting

Mentioning

260

Contrasting

Unclassified

Order By: Relevance

“…Currently, there are two main aspects in the study of basic worm propagation models. One is mainly based on the epidemiology model, including Susceptible-Infectious-Susceptible (SIS) model 25 , Kermack-Mckendrick (KM) model 26 , Two-Factor model 27 , et al This model provides a qualitative understanding of worm spread by using nonlinear different equations. In particular, KM model is also named Susceptible-Infectious-Removed (SIR) model, and is widely used as background research of other worm propagation models, SIRS model 28 for example.…”

Section: Worm Propagationmentioning

confidence: 99%

Locator/Identifier Separation: Comparison and Analysis on the Mitigation of Worm Propagation

Wan¹,

Liu²,

Tang³

et al. 2012

IJCIS

View full text Add to dashboard Cite

As a basic prerequisite for worm detection based on computational intelligence in networks with locator/identifier separation, it is well worth considering the influence on worm propagation due to the incoming locator/identifier separation. In this paper, according to the characteristics of locator/identifier separation, we systematically analyze the mitigation of worm propagation in three aspects: address semantics, address space and mapping delay. By applying the classical AAWP and SIR worm propagation models, we give a quantitative comparison between today's Internet and networks with locator/identifier separation. In particular, our research results show that, the characteristics of locator/identifier separation can help to markedly mitigate worm propagation, and networks with locator/identifier separation are more resistant to worm propagation than today's Internet.

show abstract

Section: Worm Propagationmentioning

confidence: 99%

Locator/Identifier Separation: Comparison and Analysis on the Mitigation of Worm Propagation

Wan¹,

Liu²,

Tang³

et al. 2012

IJCIS

View full text Add to dashboard Cite

show abstract

“…Nonetheless, the Internet architecture sometimes exhibits collective behaviors that make transparent end-to-end connectivity impossible. Such aggregate collective phenomena include cascading failures [20,22,29], the largest of which have been associated with worm attacks [12,35,38], and "route flapping," which occurs when a router fluctuates quickly between routes without settling into an effective routing pattern [24]. Other such phenomena include bottlenecks, storms, and collective oscillations [10,17,25].…”

Section: Internet2mentioning

confidence: 99%

Vulnerability Analysis of High Dimensional Complex Systems

Misra

Harmon

Bar‐Yam

2010

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Complex systems experience dramatic changes in behavior and can undergo transitions from functional to dysfunctional states. An unstable system is prone to dysfunctional collective cascades that result from self-reinforcing behaviors within the system. Because many human and technological civilian and military systems today are complex systems, understanding their susceptibility to collective failure is a critical problem. Understanding vulnerability in complex systems requires an approach that characterizes the coupled behaviors at multiple scales of cascading failures. We used neuromorphic methods, which are modeled on the pattern-recognition circuitry of the brain and can find patterns in high-dimensional data at multiple scales, to develop a procedure for identifying the vulnerabilities of complex systems. This procedure was tested on microdynamic Internet2 network data. The result was a generic pipeline for identifying extreme events in high dimensional datasets.

show abstract

“…Following earlier efforts [33,43,29] in understanding worms which are selfpropagating malware, several techniques have been proposed to detect and contain them. For a comprehensive overview of various types of worms, we recommend the excellent taxonomy by Weaver et al [39].…”

Section: Connections Between Exploit Code and Worm Spread Mechanismmentioning

confidence: 99%

A Fast Static Analysis Approach to Detect Exploit Code Inside Network Flows

Chinchani

Berg²

2006

Lecture Notes in Computer Science

103

View full text Add to dashboard Cite

Abstract.A common way by which attackers gain control of hosts is through remote exploits. A new dimension to the problem is added by worms which use exploit code to self-propagate, and are becoming a commonplace occurrence. Defense mechanisms exist but popular ones are signature-based techniques which use known byte patterns, and they can be thwarted using polymorphism, metamorphism and other obfuscations. In this paper, we argue that exploit code is characterized by more than just a byte pattern because, in addition, there is a definite control and data flow. We propose a fast static analysis based approach which is essentially a litmus test and operates by making a distinction between data, programs and program-like exploit code. We have implemented a prototype called styx and evaluated it against real data collected at our organizational network. Results show that it is able to detect a variety of exploit code and can also generate very specific signatures. Moreover, it shows initial promise against polymorphism and metamorphism.

show abstract

Code red worm propagation modeling and analysis

Cited by 196 publications

References 7 publications

Locator/Identifier Separation: Comparison and Analysis on the Mitigation of Worm Propagation

Locator/Identifier Separation: Comparison and Analysis on the Mitigation of Worm Propagation

Vulnerability Analysis of High Dimensional Complex Systems

A Fast Static Analysis Approach to Detect Exploit Code Inside Network Flows

Contact Info

Product

Resources

About