Understanding localized-scanning worms

被引：11

作者：

Chen, Zesheng ^{[1
]}

Chen, Chao ^{[2
]}

Ji, Chuanyi ^{[1
]}

机构：

[1] Georgia Inst Technol, Sch Elect & Comp Engn, Atlanta, GA 30332 USA

[2] Indiana Univ Purdue Univ, Dept Engn, Ft Wayne, IN 46805 USA

来源：

2007 IEEE INTERNATIONAL PERFORMANCE COMPUTING AND COMMUNICATIONS CONFERENCE, VOLS 1 AND 2 | 2007年

关键词：

D O I：

10.1109/PCCC.2007.358894

中图分类号：

TP301 [理论、方法];

学科分类号：

081202 ;

摘要：

Localized scanning is a simple technique used by attackers to search for vulnerable hosts. Localized scanning trades off between the local and the global search of vulnerable hosts and has been used by Code Red H and Nimda worms. As such a strategy is so simple yet effective in attacking the Internet, it is important that defenders understand the spreading ability and behaviors of localized-scanning worms. In this work, we first characterize the relationships between vulnerable-host distributions and the spread of localized-scanning worms through mathematical modeling and analysis, and compare random scanning with localized scanning. We then design an optimal localized-scanning strategy, which provides an upper bound on the spreading speed of localized-scanning self-propagating codes. Furthermore, we construct three variants of localized scanning. Specifically, the feedback localized scanning and the ping-pong localized scanning adapt the scanning methods based on the feedback from the probed host, and thus spread faster than the original localized scanning and meanwhile have a smaller variance.

引用

页码：186 / +

页数：2

共 18 条

[1]

BARFORD P, 2006, P PASS ACT MEAS C PA

[2]

*CERT COORD CTR, IN200109 CERT

[3]

CHEN Z, 2007, IN PRESS INT J SECUR

[4]

CHEN Z, 2007, P INFOCOM 07 ANCH AK

[5]

CHEN Z, 2005, P ACM CCS WORKSH RAP, P22

[6]

Chen ZS, 2003, IEEE INFOCOM SER, P1890

[7] Inside the slammer worm [J].

Moore, David ;

Paxson, Vern ;

Savage, Stefan ;

Shannon, Colleen ;

Staniford, Stuart ;

Weaver, Nicholas .

IEEE Security and Privacy, 2003, 1 (04) :33-39

[8]

MOORE D, 2002, ACM SIGCOMM USENIX I

[9]

RAJAB MA, 2005, P 14 USENIX SEC S SE

[10] The spread of the witty worm [J].

Shannon, C ;

Moore, D .

IEEE SECURITY & PRIVACY, 2004, 2 (04) :46-50

← 1 2 →