Worm evolution tracking via timing analysis

Abstract

We present a technique to infer a worm's infection sequence from traffic traces collected at a network telescope. We analyze the fidelity of the infection evolution as inferred by our technique, and explore its effectiveness under varying constraints including the scanning rate of the worm, the size of the vulnerable population, and the size of the telescope itself. Moreover, we provide guidance regarding the point at which our method's accuracy diminishes beyond practical value. As we show empirically, this point is reached well after a few hundred initial infected hosts (possibly including "patient zero") has been reliably identified with more than 80% accuracy. We generalize our mechanism by exploiting the change in the pattern of inter-arrival times exhibited during the early stages of such an outbreak to detect the presence and approximate size of the hit-list. Our mechanism is resilient to varying parameters like the worm scanning rate and the size of the vulnerable population, and can provide significant insights into the characteristics of the hit-list even under spreading dynamics that exceed that of currently known worms. Lastly, to illustrate the practicality of our solution, we apply our approach to real-world traces of the Witty worm and provide a refined estimate on the previously suspected hit-list size.

Online Accumulation: Reconstruction of Worm Propagation Path

“…Besides, aiming at the flow characteristics of mobile worm in wireless networks, Sarat et al [9] improved random moonwalk algorithm so that the algorithm tends to be e«ective continuously. Rajab et al [3] presented a simple technique that uses the history data acquired through a network telescope to infer the actual sequence of host infections. A di«erent approach was proposed by Kumar et al [6] where a Witty worm was reversely engineered to recover the random scanning algorithm and corresponding initial seeds.…”

“…Tracing worm's attack paths (i.e., obtaining the propagation paths of network worm) [3,5,6] can dig out the initial victims and the infect sequence of hosts. Even if only partial path can be obtained, it still has significance in worm containment, evidence collecting and investigating.…”

Characterizing InternetWorm Spatial-Temporal Infection Structures

“…Specifically, we formulate the problem of estimating the worm infection sequence as a detection problem and derive the probability of error detection for different estimators. We demonstrate analytically and empirically that our method performs much better than the algorithm proposed in the previous work [13].…”

“…We show analytically and empirically that the mean squared error of our proposed estimators can be almost half of that of the naive estimator used in the previous work [13] in inferring the host infection time.…”

“…Hamadeh et al further described a general framework to recover the infection sequence for both TCP and UDP scanning worms from network telescope data [25]. Rajab et al applied the same data and studied the "infection and detection times" to infer the worm infection sequence [13]. Different from the above works, in Chapter 3, we employ advanced statistical estimation techniques to Internet worm tomography.…”