Concept, Characteristics and Defending Mechanism of Worms

Abstract

Worms are a common phenomenon in today's Internet and cause tens of billions of dollars in damages to businesses around the world each year. This article first presents various concepts related to worms, and then classifies the existing worms into four types-Internet worms, P2P worms, email worms and IM (Instant Messaging) worms, based on the space in which a worm finds a victim target. The Internet worm is the focus of this article. We identify the characteristics of Internet worms in terms of their target finding strategy, propagation method and anti-detection capability. Then, we explore state-of-the-art worm detection and worm containment schemes. This article also briefly presents the characteristics, defense methods and related research work of P2P worms, email worms and IM worms. Nowadays, defense against worms remains largely an open problem. In the end of this article, we outline some future directions on the worm research.

An Advanced Taxonomy for Social Engineering Attacks

“…This link will direct the victim to a fake website, which the attacker has designed to obtain private and confidential information [27]. Phishing via email can be further categorized as spear-phishing, whaling, and clone-phishing [2,3,12,19,25,28,29].…”

Security Data Collection and Data Analytics in the Internet: A Survey

“…They compromise systems, steal sensitive information, congest network and launch many kinds of attacks. A worm's life consists of following phases [8,12]: (i) target finding, worm uses scanning technologies to search vulnerable hosts that can be compromised easily, (ii) transferring, worm sends its duplication to victims after the victims are discovered, (iii) activation, malicious activities of worms can be triggered based on a specific data or under a certain condition, (iv) infection, once worm has successfully infected the host, the infected host will exhibit malicious behaviors. During the first two phases, the worm is active over the Internet and causes some network anomalies, making it possible to be detected by exploiting its special behaviors.…”

“…Although we can find a number of existing surveys about DDoS and worm attacks in the literature [5][6][7][8][9][10][11][12][13][14], our survey has different focuses, provides deep review on the relationship between data categories and attack types and conducts literature evaluation based on additional requirements of data analytics. A tabulated comparison of our survey with other existing surveys of DDoS and worm attacks is presented in Table I.…”

On the trade-off between stealth and propagation speed of Internet worms

“…Internet worm propagation models describe the worm characteristics: (1) how much network traffic is generated by a worm and (2) how fast the response time should be to counteract it. Numerous models have been proposed for modeling different problems in computer networks.…”

“…Deterministic models are suitable for large-scale networks with high rate dynamics while probabilistic models are appropriate for small-scale networks with low rate dynamics. Deterministic models, such as SI and SIR, are used for modeling Internet worms because they occur in large-scale networks with thousands of hosts [1], [2]. SI [3] is a worm propagation model in which hosts stay in one of two states at any time: susceptible (denoted by 'S') or infectious (denoted by 'I').…”