worm blog

Hacking the Malware– A reverse-engineer’s analysis

A nice, thorough analysis of a Yahoo! instant messaging worm by Rahul Mohandas, showing how he decoded the exploit, reverse engineered it, and it's effects. Very good example, and something you can learn from.

This paper attempts to document an approach on how the hackers make use of the vulnerabilities to install malicious software on the vulnerable machine. A comprehensive reverse code engineered analysis of the malicious software (Win32.Qucan.a) and the various protection schemes against the worm by various security products are also discussed.

I also describe an approach to setting up a flexible laboratory environment using virtual workstation software such as VMware, and demonstrate the process of reverse engineering a worm using a range of system monitoring tools in conjunction with a disassembler.

I hope this document will help the Malware researchers, Intrusion Analysts and other Security professionals to conduct a more viable and comprehensive research.

Source: Hacking the Malware– A reverse-engineer’s analysis, by Rahul Mohandas. Pointed out by B on IRC. Thanks!

A spread model of flash worms

I can't let another week go by and not post a paper on worm modeling. This one looks at a more rigorous model of how a "Flash Worm" would work. Some decent math, it's worth the effort to make sure you understand the equations.

In this work we we introduce a mathematical model for epidemics of worms using hit-list spreading technique. Flash worms to infect the whole vulnerable population. The estimated infection time shows that even heavy network worm can potentially infect large-scale vulnerable population within few seconds. Primarily the work is based on results of the work Top Speed of Flash Worms by S. Staniford et al.. We also genralize infection doubling technique used to increase a resilience of flash worms epidemics. It took the whole day for Code Red I v2 to spread among over 350,000 Internet hosts. Slammer worm infected more than 90 percent of up to 100,000 vulnerable hosts within 10 minutes (Inside the Slammer Worm by D. Moore et al.), Witty worm infected almost all of its 12,000 victims in 45 minutes (The Spread of the Witty Worm by C. Shannon and D. Moore).

Source: A spread model of flash worms,Yury Bulygin.

And you thought you were safe after SLAMMER, not so, Swarms not Zombies present the greatest risk to our national internet infrastructure

I had a great time at WORM06 in Fairfax last week, and in my scramble to get work done in preparation for a day out of the office Wormblog updates slipped.

This paper comes from a conference on swarm intelligence and security. This is another one of those "worst worm" design papers, but it uses a novel approach: swarm intelligence.

The problem of attacks where sophisticated communities, such as BLACKHAT users, compromised larger and larger number of unsuspecting (and unsuspected) home personal computers in an effort to launch major attacks on both Government and corporate networks will be addressed in this manuscript. We called these attacks "Swarm Attacks", like a "swarm of bees". The Slammer, which is currently the fastest computer worm in recorded history, is an early precursor to this class of threat. Most proposed countermeasures strategies proposed to deal with such attacks, are based primarily on rate detection and limiting algorithms, or the detection of a sudden increased occurrence of "Destination Unreachable" messages in a network. However, we speculate that such strategies will prove ineffective in the future.

In this manuscript we will introduce the basic principles behind the idea of such "Swarm Worms", the nature of the intelligent behavior that emerges, as well as the basic structure required in order to be considered a "swarm worm", based on our definition. In addition, we will present preliminary results on the propagation speeds of one such swarm worm, called the ZachiK worm. We will show that ZachiK is capable of propagating at a rate 2 orders of magnitude faster than similar worms without swarm capabilities while remaining stealthy.

Source: And you thought you were safe after SLAMMER, not so, Swarms not Zombies present the greatest risk to our national internet infrastructure, Fernando C. Colon Osorio and Zachi Kloppman.

Aim For Bot Coordination

A paper from this year's Virus Bulletin conference that explores IM-based botnet communication channels. While not too long (only 3 pages), it highlights some of the attractive features about the AIM protocol Oscar that could be useful for bots.

In the last few years, there has been increasing interest within the virus-writing community in Internet Relay Chat (IRC) based malware, due to the power afforded by the IRC scripting language and the ease of coordinating infected machines from a chat-room type of structure. What has developed is a very modular, open-source sort of threat which is very rapidly adapted to include new functionality and new infection vectors. More recently, there has also been an increase in the number of threats spreading through Instant Messaging (IM) clients, particularly OSCAR-based clients like AOL Instant Messenger (AIM). IRC bots have begun using this functionality to spread, but there is more capability available within OSCAR than is currently being exploited.

As there has also been an increase in the number of bots using Command and Control (C&C;) channels that utilize something other than IRC (primarily web-based currently), it stands to reason that there may be a possibility of virus-writers using OSCAR as a means of control. This paper looks to explore the capabilities of OSCAR for being used in C&C; scenarios, and what steps could be taken to mitigate this proactively.

Source: Aim For Bot Coordination, Lysa Myers, from Virus Bulletin 2006.

Software Decoys: Intrusion Detection and Countermeasures

Following VB, I got to thinking about some of my previous positions on AV and thought about just how hard a problem it is, at times. This paper sort of fits into that thinking, basically trying to discriminate malicious activity from normal activity, a somewhat related topic.

We introduce the notion of an intelligent software decoy, and provide both an architecture and event-based language for automatic implementation of them. Our decoys detect and respond to patterns of suspicious behavior, and maintain a repository of rules for behavior patterns and decoying actions. As an example, we construct a model of system behavior from an initial list of event types and their attributes in the interaction between computer worms and an operating system. The model represents patterns of suspicious or malicious events that the software decoy should detect, and specific actions to be taken in response. Our approach explicitly treats both standard and nonstandard invocations of components, with the latter representing an attempt to circumvent the public interface of the component.

Source: Software Decoys: Intrusion Detection and Countermeasures, James Bret Michael, Senior Member, IEEE, Mikhail Auguston, Neil C. Rowe, and Richard D. Riehle.

Global Intrusion Detection in the DOMINO Overlay System

To continue a theme from Monday about using a distributed sensor network, this is one of the premeier papers in this arena. DOMINO and it's applicability to the worm problem is well covered in this paper. In it, the authors describe how they efficiently detected major worm outbreaks.

Sharing data between widely distributed intrusion detection systems offers the possibility of significant improvements in speed and accuracy over isolated systems. In this paper, we describe and evaluate DOMINO (Distributed Overlay for Monitoring InterNet Outbreaks); an architecture for a distributed intrusion detection system that fosters collaboration among heterogeneous nodes organized as an overlay network. The overlay design enables DOMINO to be heterogeneous, scalable, and robust to attacks and failures. An important component of DOMINO's design is the use of active-sink nodes which respond to and measure connections to unused IP addresses. This enables efficient detection of attacks from spoofed IP sources, reduces false positives, enables attack classification and production of timely blacklists.

We evaluate the capabilities and performance of DOMINO using a large set of intrusion logs collected from over 1600 providers across the Internet. Our analysis demonstrates the significant marginal benefit obtained from distributed intrusion data sources coordinated through a system like DOMINO. We also evaluate how to configure DOMINO in order to maximize performance gains from the perspectives of blacklist length, blacklist freshness and IP proximity. We perform a retrospective analysis on the 2002 SQL-Snake and 2003 SQL-Slammer epidemics that highlights how information exchange through DOMINO would have reduced the reaction time and false-alarm rates during outbreaks. Finally, we provide preliminary results from our prototype active-sink deployment that illustrates the limited variability in the sink traffic and the feasibility of efficient classification and discrimination of attack types

Source: Global Intrusion Detection in the DOMINO Overlay System, Vinod Yegneswaran, Paul Barford, Somesh Jha.

Robust Reactions to Potential Day-Zero Worms through Cooperation and Validation

While I'm back from VB, I've also been very busy with work, so posts here slipped a bit.

The COVERAGE algorithm outlined here seems like a decent first step at solving a very knotty problem. This is worth reading if you've given thought to a cooperative IDS system, or even if you just want to look at a specific subset of data correlation across multiple devices.

Cooperative defensive systems communicate and cooperate in their response to worm attacks, but determine the presence of a worm attack solely on local information. Distributed worm detection and im- munization systems track suspicious behavior at multiple cooperating nodes to determine whether a worm attack is in progress. Earlier work has shown that cooperative systems can respond quickly to day-zero worms, while distributed defensive systems allow detectors to be more conservative (i.e. paranoid) about potential attacks because they manage false alarms efficiently.

In this paper we begin a preliminary investigation into the complex tradeoffs in such systems between communication costs, computation overhead, accuracy of the local tests, estimation of viral virulence, and the fraction of the network infected before the attack crests. We evaluate the effectiveness of different system configurations in various simulations. Our experiments show that distributed algorithms are better able to bal- ance effectiveness against viruses with reduced cost in computation and communication when faced with false alarms. Furthermore, cooperative, distributed systems seem more robust against malicious participants in the immunization system than earlier cooperative but non-distributed approaches.

Source: Robust Reactions to Potential Day-Zero Worms through Cooperation and Validation, K. Anagnostakis, S. Ioannidis, A. D. Keromytis, and M. B. Greenwald.

An epidemiological model of virus spread and cleanup

Quite a good, focused paper on the outbreak of malware.

Signature based anti-virus technologies are widely used to fight computer viruses. It is difficult to evaluate such systems because they work in the wild and few companies would be willing to turn them off to be part of a control group! This paper presents a new model of these technologies that can be used to predict and evaluate their effectiveness. The paper will demonstrate how the model can be used to understand the overall system dynamics, calculate expected costs of outbreaks, give insight into the relative importance of parts of the system and suggest ways to improve the technology. It is also used to evaluate new approaches to fighting viruses.

Source: An epidemiological model of virus spread and cleanup,  Williamson, Matthew M.; Laeveillae, Jasmin.

Worms of the future: Trying to exorcise the worst

Another "worst case" scenario, but this one has seen a few of the preditions (ie messing with debuggers) come true in the botnet world.

According to [Wikipedia], a worm could be defined as: a self-replicating computer program that does not need to be part of another program to propagate itself. This document is an attempt at predicting the worst possible future of worms, given the current computer science possibilities.

Up to now, we've seen many different kind of worms, each new generation improving on the precedent. The fact is that all such threats, for now, have suffered from a few vulnerabilities that prevented them (much to our relief) from functioning to their full potential. Some have achieved their result to a greater extent than others, but none of them seem to have realised the greatest fear: wreaking havoc on the Internet and on Informations Systems on a global scale (although some have come close).

This document tries to look at these present vulnerabilities from a security point of view (that is, by considering the Confidentiality, Integrity and Availability of worms) and in the next chapter, how to maintain these security requirements throughout the life-span of the worm, that is to say, as long as possible.

Following this, the document then attempts to provide hints on solutions that could be used in defense against new threats.

As it has been pointed out to me, other similar papers exist, one of them being [Warhol]. Surely a nice complementary reading to this paper.

Source: Worms of the future: Trying to exorcise the worst, by Nicolas Stampf.

On the Design and Use of Internet Sinks for Network Abuse Monitoring

Work's been busy again, I didn't have much of a chance to stack up some posts last week. This week I head to Virus Bulletin in Montreal (ping me if you're there), so I'll stack up some posts and keep it on auto-pilot.

The iSink architecture paper is a worthwhile read to study large-scale collection and analysis methods. Such methods are usually used to detect new worms.

Monitoring unused or dark IP addresses offers opportunities to significantly improve and expand knowledge of abuse activity without many of the problems associated with typical network intrusion detection and firewall systems. In this paper, we address the problem of designing and deploying a system for monitoring large unused address spaces such as class A telescopes with 16M IP addresses. We describe the architecture and implementation of the Internet Sink (iSink) system which measures packet traffic on unused IP addresses in an efficient, extensible and scalable fashion. In contrast to traditional intrusion detection systems or firewalls, iSink includes an active component that generates response packets to incoming traffic. This gives the iSink an important advantage in discriminating between different types of attacks (through examination of the response payloads). The key feature of iSink’s design that distinguishes it from other unused address space monitors is that its active response component is stateless and thus highly scalable. We report performance results of our iSink implementation in both controlled laboratory experiments and from a case study of a live deployment. Our results demonstrate the efficiency and scalability of our implementation as well as the important perspective on abuse activity that is afforded by its use.

Source: On the Design and Use of Internet Sinks for Network Abuse Monitoring, Vinod Yegneswaran, Paul Barford, and Dave Plonka.

A Theoretical Superworm

The ISTS at Dartmouth has been doing some great computer security research over the years. This is a report of theirs from 2002.

This report will explain the current model of vulnerability detection, assessment, and response. The current cycle is as follows:

• Identification of vulnerability
  • Inform security community and/or appropriate vendor and/or press
  • Scan for possible existing exploits of vulnerability
• Development of response, i.e. patches
  • Inform the community of security measures to be taken
  • Hope everyone takes responsibility for applying patches
• Observe effects of vulnerability/exploit on unprepared systems
• Learn from observations, develop new strategies and tactics, and identify new vulnerabilities

The creation of a SuperWorm, malicious code written to incorporate the most successful features of known worms and other malware, could threaten the economy or national security.

The SuperWorm has three tasks:

The worm’s programmer identifies multiple exploitation vulnerabilities that affect a large number of operating systems

Propagation

Delivery of payload and damage The SuperWorm programmer could learn from and utilize the speed of Code Red and CodeRed2, the multiple means of proliferation utilized by Nimda, the ability to incorporate other virus code to be transported with the worm seen with variations of the Klez worm, the ability to access and send files from a hard drive as seen with SirCam, and the destructive payload of Magistr.

The Incident at XYZ University provides an example of a network that was established with information sharing and open education in mind. The security features of the network do not provide adequate protection against an advanced threat. Additionally, the limited resources of the systems administrators do not facilitate either the rapid response to vulnerabilities or the collection and analysis of the evidence of an attack. These factors limit the ability of the administrators of this network, and networks similar to this University, to defend their system against a sophisticated, rapid cyberattack.

The early warning system described in the Early Detection of Active Internet Worms by Metering ICMP Destination Unreachable Messages section provides an example of a security technology capable of detecting worm activity. Early detection will allow security experts to learn about the technical specifications of the worm, and the vulnerabilities exploited by the worm, and give them time to develop a response to the threat. Additionally, the warning system provides data for further analysis of worm and attacker behavior that will enhance the ability to defend against future attacks.

The Modified Reverse Proxy Server (JEANNE) is an example of a security technology that mitigates the threat of worm proliferation on a web server. The technology is a proactive means to address possible threats before they manifest themselves in the wild.

Source: A Theoretical Superworm.

Early Detection Of Active Internet Worms

This is a paper from a few years ago that looks at the detection of a worm through failed reply traffic.

An active Internet worm is malicious software that autonomously searches for and infects vulnerable hosts, copying itself from one host to another and spreading through the susceptible population. Most recent worms find vulnerable hosts by generating random IP addresses and then probing those addresses to see which are running the desired vulnerable services. Detection of such worms is a manual process in which security analysts must observe and analyze unusual network or host activity, and the worm might not be positively identified until it already has spread to most of the Internet. In this chapter, we present an automated system that can identify active scanning worms soon after they begin to spread, a necessary precursor to halting or slowing the spread of the worm. Our implemented system collects ICMP Destination Unreachable messages from instrumented routers, identifies message patterns that indicate malicious scanning activity, and then identifies scan patterns that indicate a propagating worm. We examine an epidemic model for worm propagation, describe our ICMP-based detection system, and present simulation results that illustrate its detection capabilities.

Early Detection Of Active Internet Worms, Vincent H. Berk, George V. Cybenko and Robert S. Gray. You may remember that Berk has done a low of work on using ICMP unreachable messages to detect worm activity.

Work's been very busy, so I haven't had a lot of time to post.

Optimising Malware

In this paper, the authors look at ways of fine tuning the efficacy of malware, ie making it speedier and more lethal.

In recent years, malicious software (malware) has become one of the most insidious threats in computer security, having been used, in its various forms, with high level of success for a myriad of nefarious purposes. However, this is arguably not the result of increased sophistication in malware design or attack strategies, but rather of the increased presence of computers and computer networks within every aspect of society, offering an increased number of services through increasingly complex and vulnerability-ridden software.

In this paper, we address and defend the commonly shared point of view that the worst is very much yet to come. We introduce an aim-oriented performance theory for malware and malware attacks, within which we identify some of the performance criteria for measuring their “goodness” with respect to some of the typical objectives for which they are currently used. We also use the OODA-loop model, a wellknown paradigm of command and control borrowed from military doctrine, as a tool for organising (and reasoning about) the behavioural characteristics of malware and orchestrated attacks using it. We then identify and discuss particular areas of malware design and deployment strategy in which very little development has been seen in the past, and that are likely sources of increased future malware threats. Finally, we discuss how standard optimisation techniques could be applied to malware design, in order to allow even moderately equipped malicious actors to quickly converge towards optimal malware attack strategies and tools fine-tuned for the current Internet.

Source: Optimising Malware, José M. Fernandez and Pierre-Marc Bureau.

Update 5 October: Update the paper link to a newer version, from Pierre-Marc.

Enabling Internet Worms And Malware Investigation And Defense Using Virtualization

While lengthy, it's good reading if you're wondering about large-scale studies of real malware in a controlled laboratory network setting.

Internet worms and malware remain a threat to the Internet, as demonstrated by a number of large-scale Internet worm outbreaks, such as the MSBlast worm in 2003 and the Sasser worm in 2004. Moreover, every new wave of outbreak reveals the rapid evolution of Internet worms and malware in terms of infection speed, virulence, and sophistication. Unfortunately, our capability to investigate and defend against Internet worms and malware has not seen the same pace of advancement.

In this dissertation, we present an integrated, virtualization-based framework for malware capture, investigation and defense. This integrated framework consists of a frontend and a back-end. The front-end is a virtualization-based honeyfarm architecture, called Collapsar, to attract and capture real-world malware instances from the Internet. Collapsar is the first honeyfarm that virtualizes full systems and enables centralized management of honeypots while preserving their distributed presence. The back-end is a virtual malware "playground," called vGround, to perform destruction-oriented experiments with captured malware or worms, which were previously expensive, inefficient, or even impossible to conduct.

On top of the integrated framework, we have developed a number of defense mechanisms from various perspectives. More specifically, based on the unique infection behavior of each worm we run in vGround, we define a behavioral footprinting model for worm profiling and identification, which complements the state-of-the-art content-based signature approach. We also develop a provenance-aware logging mechanism, called process coloring, that achieves higher efficiency and accuracy than existing systems in revealing malware break-ins and contaminations.

Source: Enabling Internet Worms And Malware Investigation And Defense Using Virtualization, a Ph.D. thesis by Xuxian Jiang.

Intelligent Worms: Searching for Preys

Another paper showing why, at least in theory, a worm that has some roadmap about its victims should be more efficient than one that blindly looks for victims.

Internet worms have been a persistent security threat in recent years since the Morris worm arose in 1988. After the Code Red and Nimda worms were released into the Internet in 2001, the Slammer worm was unleashed with a 376-byte User Datagram Protocol (UDP) packet and infected at least 160,000 computers worldwide on January 25, 2003. Later, the Blaster and Witty worms flooded the Internet in 2003 and 2004, respectively. These active worms caused large parts of the Internet to be temporarily inaccessible, costing both public and private sectors millions of dollars. The frequency and virulence of active-worm outbreaks have been increasing dramatically in the last few years, presenting a significant threat to today's Internet. In this article, we review the prey-searching methods that worms use currently, and may potentially exploit in the future. While reviewing what has been used by worms is doable, predicting what worms may use seems to be prohibitive: There would be million ways for active worms to attack the Internet. We show how mathematics has been playing an important role in providing both a guidance and methodology in studying current and futuristic worm attacks. In particular, we outline how mathematical tools (e.g., epidemic model, statistics, machine learning, and game theory) can be applied in this area.

Source: Intelligent Worms: Searching for Preys, by Zesheng Chen and Chuanyi Ji.

Experiences Using Minos as A Tool for Capturing and Analyzing Novel Worms for Unknown Vulnerabilities

Time got away from me the past few days, better late than never. This is an interesting paper mixing host-level behaviors with detecting new worm activity.

We present a honeypot technique based on an emulated environment of the Minos architecture and describe our experiences and observations capturing and analyzing attacks. The main advantage of a Minos-enabled honeypot is that exploits based on corrupting control data can be stopped at the critical point where control ow is hijacked from the legitimate program, facilitating a detailed analysis of the exploit. Although Minos hardware has not yet been implemented, we are able to deploy Minos systems with the Bochs full system Pentium emulator. We discuss complexities of the exploits Minos has caught that are not accounted for in the simple model of "buffer overflow exploits" prevalent in the literature. We then propose the Epsilon-Gamma-Pi model to describe control data attacks in a way that is useful towards understanding polymorphic techniques. This model can not only aim at the centers of the concepts of exploit vector (ε), bogus control data (γ), and payload (π); but also give them shape. This paper will quantify the polymorphism available to an attacker for γ and π, while so characterizing ε is left for future work.

Source: Experiences Using Minos as A Tool for Capturing and Analyzing Novel Worms for Unknown Vulnerabilities, Jedidiah R. Crandall, S. Felix Wu, and Frederic T. Chong.

Simulation and Analysis on the Resiliency and Efficiency of Malnets

More work by the team from yesterday's paper, again on difficult to remove malware.

Future network intruders will probably use an organized army of malicious nodes (here called "malnodes", or collectively a "malnet") to deliver many different attacks, rather than recruiting a disorganized set of compromised nodes per attack. However, partly due to the lack of understanding of the resiliency and efficiency a malnet can have, countering malnets has been ineffctive.

This paper begins to address this defficiency Through calculation and simulation for three representative malnets|random, small-world, and Gnutella-like|we show that extremely resilient malnets can be formed to deliver attack code quickly. In particular, we show that disconnecting malnets is possible, but extremely naive approaches such as randomly disinfecting malnodes will not suffice, and effective defenses must either happen very quickly during a second-wave attack, or take effect prior to it.

Source: Simulation and analysis on the resiliency and efficiency of malnets, Jun Li, Toby Ehrenkranz, Geoff Kuenning, and Peter Reiher, in Proceedings of the 19th Workshop on Principles of Advanced and Distributed Simulation PADS '05.

Midgard Worms: Sudden Nasty Surprises from a Large Resilient Zombie Army

Almost another "worst-case worm scenario", but unlike most people propose self-defending worms, these folks actually do some design and analysis of how it may work.

Future network intruders will probably use a zombie army to deliver many different attacks, rather than recruiting a new army per attack. We describe a Midgard Worm, which can build an extremely resilient and scalable overlay network to deliver attack code quickly. The worm's master could disseminate a 1-megabyte exploit or upgrade to a million zombies from any zombie in less than six minutes. Even if 80% of the zombies were disinfected, 70% of the remainder would remain connected and ready to receive new exploits. We discuss the basic design principles behind such a worm and methods of combating this kind of attack.

Source: Midgard Worms: Sudden Nasty Surprises from a Large Resilient Zombie Army, by Peter Reiher, Jun Li, and Geoff Kuenning.

A Distributed Host-based Worm Detection System

Not a new idea, but this paper does a pretty good job of explaining the algorithms in use.

We present a method for detecting large-scale worm attacks using only end-host detectors. These detectors propagate and aggregate alerts to cooperating partners to detect largescale distributed attacks in progress. The properties of the host-based detectors may in fact be relatively poor in isolation but when taken collectively result in a high-quality distributed worm detector. We implement a cooperative alert sharing protocol coupled with distributed sequential hypothesis testing to generate global alarms about distributed attacks. We evaluate the system's response in the presence of a variety of false alarm conditions and in the presence of an Internet worm attack. Our evaluation is conducted with agents on the Emulab and DETER emulated testbeds using real operating systems and computing platforms.

Source: A Distributed Host-based Worm Detection System, Senthilkumar G. Cheetancheri, John Mark Agosta, Denver H. Dash, Karl N. Levitt, Jeff Rowe, Eve M. Schooler.

Is BGP Update Storm a Sign of Trouble: Observing the Internet Control and Data Planes During Internet Worms

I recall doing some analysis when SQLSlammer hit, and looking over the routing data I had available to me. It was a pretty disruptive 36 hours or so, honestly, and looking over the changes in the network, I saw an avergae of three BGP messages for every network that was affected. This appearantly mapped to a BGP withdaw message, an announcement, and then a path update message. What's interesting in this work is that they line up such BGP data with reachability measurements, which I did not have access to at the time.

There are considerable reasons to wish to understand the relationship between the Internet’s control and data planes in times for stress. For example, the much publicized Internet worms—Code Red, Nimda and SQL Slammer—caused BGP storms, but there has been comparatively little study of whether the storms impacted network performance. In this paper, we study these worm events and see whether the BGP storms observed during the worms actually corresponded to problems in the Internet’s data plane. By processing and analyzing two datasets from RIPE, we have found that while BGP update storms occurred in all three worms, the performance of the data plane degraded during the Slammer worm but did not during the Code Red and the Nimda. No direct correlation should be drawn between the degradation of the Internet data plane and the occurrence of a BGP update storm—it may not be a sign of trouble but a sign of the Internet control plane doing its job.

Source: Is BGP Update Storm a Sign of Trouble: Observing the Internet Control and Data Planes During Internet Worms, by Matthew Roughan, Jun Li, Randy Bush, Zhuoqing Mao and Timothy Griffin, Proceedings of SPECTS 2006.

A Study of Massmailing Worms

Mass-mailer worms get the short end of the stick here on Wormblog. They're usually derivatives of eachother, at this point, and while they can disrupt an enterprise's e-mail infrastructure, they don't usually display much novelty. Detection is also pretty easy. So, a paper like this is nice to see.

Mass-mailing worms have made a significant impact on the Internet. These worms consume valuable network resources and can also be used as a vehicle for DDoS attacks. In this paper, we analyze network traffic traces collected from a col- lege campus and present an in-depth study on the effects of two mass-mailing worms, SoBig and MyDoom, on outgoing traffic. Rather than proposing a defense strategy, we focus on studying the fundamental behavior and characteristics of these worms. This analysis lends insight into the possibili- ties and challenges of automatically detecting, suppressing and stopping mass-mailing worm propagation in an enter- prise network environment.

Source: A Study of Massmailing Worms, Cynthia Wong, Stan Bielski, Jonathan M. McCune, Chenxi Wang, from WORM04.

A Distributed Host-Based Worm Detection System

I've posted papers describing the approach of using collaborative host-based detection tools for worm outbreaks previously. This is some more research from Cheetancher on the subject.

We present a method for detecting large-scale worm attacks using only end-host detectors. These detectors propagate and aggregate alerts to cooperating partners to detect largescale distributed attacks in progress. The properties of the host-based detectors may in fact be relatively poor in isolation but when taken collectively result in a high-quality distributed worm detector. We implement a cooperative alert sharing protocol coupled with distributed sequential hypothesis testing to generate global alarms about distributed attacks. We evaluate the system's response in the presence of a variety of false alarm conditions and in the presence of an Internet worm attack. Our evaluation is conducted with agents on the Emulab and DETER emulated testbeds using real operating systems and computing platforms.

Source: A Distributed Host-Based Worm Detection System. Senthilkumar G. Cheetancheri, John Mark Agosta, Denver H. Dash, Karl N. Levitt, Jeff Rowe, Eve M. Schooler, Proceedings of the ACM SIGCOMM Workshop on Large Scale Attack Defense (LSAD06).

Towards a framework for Worm Defense Evaluation

Part of Senthilkumar Cheetancheri's Ph.D. research, this is a brief paper describing the framework they built for setting up experiments in the EMIST/DETER testbed.

Computer worms are a serious problem. Much research has been done to detect and contain worms. One major de- ficiency in most research is that the claims are supported by theoretic models or simulations only and not by realistic tests. Network testbeds such as emulab and deter can be used to conduct worm experiments on networks of a few hundreds nodes. However, setting up such an experiment is not trivial. In this paper, we describe a wrapper around emulab to deploy such experiments quickly. We also demonstrate its use by evaluating an example worm containment strategy.

Source: Towards a framework for Worm Defense Evaluation, Senthilkumar G Cheetancheri, Denys Ma, Todd Heberlien, Karl Levitt Proceedings of the IEEE IPCCC Workshop on Swarm Intelligence(MALWARE'06) Apr'06.

Automatically deducing propagation sequences that circumvent a collaborative worm defense

A veyr short paper (only 6 pages), but this one is worm defense flipped on it's ear: the worm defends is propagation strategy. Kind of neat.

We present an approach to the question of evaluating worm defenses against future, yet unseen, and possibly defense-aware worm behavior. Our scheme employs model checking to produce worm propagation sequences that defeat a worm defense of interest. We demonstrate this approach using an exemplar collaborative worm defense, in which LANs share alerts about encountered infections. Through model checking experiments, we then generate propagation sequences that are able to infect the whole population in the modeled network. We discuss these experimental results and also identify open problems in applying formal methods more generally in the context of worm quarantine research.

Source: Automatically deducing propagation sequences that circumvent a collaborative worm defense. Linda Briesemeister and Phillip A. Porras. In Proceedings of the 25th International Performance Computing and Communications Conference (Workshop on Malware), pages 587-592, April 2006.

Formally Specifying Design Goals of Worm Defense Strategies

A formal paper, but this is one of a small set of interesting works I'll post this week. While this is a short work (it's an extended abstract), it provides a nice framework to think about worm defense measures.

There are many key challenges to developing the apparatus and methodologies necessary to evaluate the emerging suite of approaches to large-scale worm defense. Within the DETER/EMIST initiative, challenges that have arisen during the development of our experimental framework include the need to support experiment repeatability, greater scalability in network topology, and greater realism in traffic dynamics. Among these key challenges, we also seek to expand the rigor with which we model the protection claims of the worm defense algorithm, particularly as we design tests that we hope can fully stress and evaluate the protection claims of the algorithm of interest.

To date, most of the work in understanding the behavior of malicious code propagation and defense has centered exclusively on understanding the effects of a proposed malware countermeasure on the global infection growth rate given a specific modeled network and malicious code scenario. In this study we consider how to more rigorously express design goals regarding the local impact of a defensive algorithm from the perspective of those who participate in the defense. We contrast this perspective of local benefit from what we view as the current tradition of evaluating worm defense performance based on assessing growth rate impact on an abstracted topology of global population.

Source: Formally specifying design goals of worm defense strategies. Linda Briesemeister and Phillip A. Porras. Proceedings of DETER Community Workshop on Cyber Security Experimentation and Test, June 2006.

CyberTrap: Detecting and Quarantining Scanning Worms in Enterprise Networks

Another paper on using a large network monitor to find worms and then trap them.

The safety and reliability of current Internet and various enterprise networks have been constantly challenged by the increased frequency and virulence of worm outbreaks. Unfortunately, the situation is getting worse by the following observations: (1) security practices have discovered more worm-friendly vulnerabilities than before; (2) research results show that better-engineered worms likeWarhol worms and Flash worms could spread across the Internet within just 15 minutes or even 30 seconds.

To address these challenges, this paper proposes Cyber- Trap, a systematic approach to mitigate worm propagation. Due to worms’ scanning nature, every IP address in current IPv4 (2³²) space will be intended by live worms with certain probability. CyberTrap takes a defensive use of unused or darknet IP space: firstly, CyberTrap accurately identifies worm instances by trapping them with the darknet space; then CyberTrap actively takes counter-measures, like firewalling or blackholing, to quarantine those worms after collecting infection facts. This paper presents formal analysis of CyberTrap and examines its effectiveness and responsiveness in protecting enterprise networks. Both analytical and simulation results show that deployment of CyberTrap with a =10 internal or external darknet space in one enterprise could effectively limit infectious worm percentage within that enterprise to less than 3%.

Source: CyberTrap: Detecting and Quarantining Scanning Worms in Enterprise Networks, Xuxian Jiang and Dongyan Xu.

A Multi-Resolution Approach forWorm Detection and Containment

An interesting paper. I worry it's more complicated than it needs to be, though.

Despite the proliferation of detection and containment techniques in the worm defense literature, simple threshold-based methods remain the most widely deployed and most popular approach among practitioners. This popularity arises out of the simplistic appeal, ease of use, and independence from attack-specific properties such as scanning strategies and signatures. However, such approaches have known limitations: they either fail to detect low-rate attacks or incur very high false positive rates. We propose a multi-resolution approach to enhance the power of threshold-based detection and rate-limiting techniques. Using such an approach we can not only detect fast attacks with low latency, but also discover low-rate attacks – several orders of magnitude less aggressive than today’s fast propagating attacks – with low false positive rates. We also outline a multi-resolution rate limiting mechanism for throttling the number of new connections a host can make, to contain the spread of worms. Our trace analysis and simulation experiments demonstrate the benefits of a multiresolution approach for worm defense.

Source: A Multi-Resolution Approach for Worm Detection and Containment, Vyas Sekar. Yinglian Xie, Michael K. Reiter, Hui Zhang.

Detecting Intra-Enterprise Scanning Worms Based on Address Resolution

Another paper that looks at the fact that when worms scan for victims, they generate a lot of failed connection attempts. By looking at the signs of these failures - TCP RSTs, ICMP unreachable errors, or, in this case, ARP traffic - you can efficiently find active worms.

Signature-based schemes for detecting Internet worms often fail on zero-day worms, and their ability to rapidly react to new threats is typically limited by the requirement of some form of human involvement to formulate updated attack signatures. We propose an anomaly-based detection technique detailing a method to detect propagation of scanning worms within individual network cells, thus protecting internal networks from infection by internal clients. Our software implementation indicates that this technique is both accurate and rapid enough to enable automatic containment and suppression of worm propagation within a network cell. Our approach relies on an aggregate anomaly score, derived from the correlation of Address Resolution Protocol (ARP) activity from individual network attached devices. Our preliminary analysis and prototype indicate that this technique can be used to rapidly detect zero-day worms within a very small number of scans.

Source: Detecting Intra-Enterprise Scanning Worms Based on Address Resolution, D. Whyte, P.C. van Oorschot, E. Kranakis.

A Monitoring System for Detecting Repeated Packets with Applications to Computer Worms

An interesting paper that proposes a design to efficiently count the frequency of similar observations. When a worm attempts to propagate, the initial attack vectors will look the same for standard worms (excluding polymorphic worms) from one or more sources to a growing number of destinations. This paper attempts to exploit that fact and discover when a worm is active by looking at the payload in a time-space efficient fashion.

We present a monitoring system which detects repeated packets in network traffic, and has applications including detecting computer worms. It uses Bloom filters with counters. The system analyzes traffic in routers of a network. Our preliminary evaluation of the system involved traffic from our internal lab and a well known historical data set. After appropriate configuration, no false alarms are obtained under these data sets and we expect low false alarm rates are possible in many network environments. We also conduct simulations using real Internet Service Provider topologies with realistic link delays and simulated traffic. These simulations confirm that this approach can detect worms at early stages of propagation. We believe our approach, with minor adaptations, is of independent interest for use in a number of network applications which benefit from detecting repeated packets, beyond detecting worm propagation. These include detecting network anomalies such as dangerous traffic fluctuations, abusive use of certain services, and some distributed denial-of-service attacks.

A Monitoring System for Detecting Repeated Packets with Applications to Computer Worms, P.C. van Oorschot, J.M. Robert, M. Vargas Martin.

Instant Messaging Worms, Analysis and Countermeasures

IM worms are an interesting beast. They have both built-in speedups for propagation via a buddy list, an a great control mechanism in the message routers for each network. We haven't seen the end of them, but they seem to be dominated by bots using link-spamming techniques to propagate. This paper, from WORM05, proposes throttling (which works) and CAPTCHA mechanisms to give a challenge-response mechanism for possibly malicious content. As I recall, the latter wasn't well received by the audience at WORM05, who felt that if you suspected content was dangerous why don't you just block it.

We provide a collection of minor results on the area of Instant Messaging (IM) worms, which has received relatively little attention in the formal literature. We review selected IM worms and summarize their main characteristics, motivating a brief overview of the network formed by IM contact lists, and a discussion of theoretical consequences of worms in such networks. Existing methods to restrict an IM worm epidemic are analyzed in terms of usability and effectiveness, leading to the suggestion of two minor variations to limit IM worm propagation. We believe these variations are more user-friendly and effective than existing published methods. We also provide brief results of a three and a half year user study of IM text messaging and file transfer frequency in a moderate-size public IM network – the largest such study to date – which is of independent interest, but also supports in part the preceding claim regarding user-friendliness.

Source: Instant Messaging Worms, Analysis and Countermeasures, M. Mannan, P.C. van Oorschot. WORM 2005 (ACM Workshop on Rapid Malcode).

A Topologically-Aware Worm Propagation Model for Wireless Sensor Networks

Another paper from Khayam, this one is from the year before and covers some similar ground, namely worms in a wireless network.

Internet worms have repeatedly revealed the susceptibility of network hosts to malicious intrusions. Recent studies have proposed to employ the underlying principles of worm propagation to disseminate security-critical information in a network. Wireless sensor networks can benefit from a thorough understanding of worm propagation over sensor networks to defend from worms and to efficiently disseminate security-critical information. In this paper, we develop a topologically-aware worm propagation model (TWPM) for wireless sensor networks. In addition to simultaneously capturing both time and space propagation dynamics, the TWPM also incorporates physical, MAC and network layer considerations of practical sensor networks. Simulation results show that the proposed model follows actual propagation dynamics quite closely.

Source: "A Topologically-Aware Worm Propagation Model for Wireless Sensor Networks," Syed A. Khayam and Hayder Radha,  IEEE ICDCS International Workshop on Security in Distributed Computing Systems (SDCS), June 2005. (pdf)

An Inside Look at Botnets

This is one of the better, most complete overviews of the botnet problem available today. Not surprisingly, it's from a noted security researcher.

The continued growth and diversification of the Internet has been accompanied by an increasing prevalence of attacks and intrusions. It can be argued, however, that a significant change in motivation for malicious activity has taken place over the past several years: from vandalism and recognition in the hacker community, to attacks and intrusions for financial gain. This shift has been marked by a growing sophistication in the tools and methods used to conduct attacks, thereby escalating the network security arms race.

Our thesis is that the reactive methods for network security that are predominant today are ultimately insufficient and that more proactive methods are required. One such approach is to develop a foundational understanding of the mechanisms employed by malicious software (malware) which is often readily available in source form on the Internet. While it is well known that large IT security companies maintain detailed databases of this information, these are not openly available and we are not aware of any such open repository. In this paper we begin the process of codifying the capabilities of malware by dissecting four widely-used Internet Relay Chat (IRC) botnet codebases. Each codebase is classified along seven key dimensions including botnet control mechanisms, host control mechanisms, propagation mechanisms, exploits, delivery mechanisms, obfuscation and deception mechanisms. Our study reveals the complexity of botnet software, and we discusses implications for defense strategies based on our analysis.

Source: A Look Inside Botnets, Barford, Paul and Yegneswaran, Vinod. To appear in Series: Advances in Information Security, Springer, 2006.

Using Signal Processing Techniques to Model Worm Propagation over Wireless Sensor Networks

Another neat paper that looks at worm propagation in a non-traditional network medium. The constraints found in such networks is offset by the opportunities they provide for long distance travel. This is increasingly important with PDA-based malware.

In this article, we define worm propagation characteristics that are specific to sensor networks. We parameterize the effects of physical channel conditions, medium access control (MAC) layer contention, network layer routing, and transport layer protocol on worm propagation in sensor networks. These parameters are incorporated in the TWPM, which borrows its basic formulation from models of epidemic diseases. The advanced model parameters and the mathematical treatment following the formulation are then developed specifically for sensor networks. The basic model formulation results in a partial differential equation, which is solved in the frequency domain to yield a closed-form solution for the TWPM. It is shown that in the spatial domain the TWPM spread function is low-pass filtered by a two-dimensional (2-D) isotropic Gaussian filter, thereby providing an intuitive feel for the dependence of the model on its underlying (physical, MAC, and network layer) parameters. For performance evaluation, we simulate the spread of a worm over a sensor network. The simulated and TWPM-predicted worm propagation dynamics are then compared to evaluate the accuracy of the model. We show that the TWPM predicts the worm propagation dynamics very accurately.

Source: "Using Signal Processing Techniques to Model Worm Propagation over Wireless Sensor Networks," Syed A. Khayam and Hayder Radha, IEEE Signal Processing Magazine, vol. 23, no. 2, pp. 164-169, March 2006.

An Improved Worm Mitigation Model for Evaluating the Spread of Aggressive Network Worms

This is a short paper, but if you're interested in the math behind epidemiological modeling of worm outbreaks, this one should be interesting to you.

An enhancement to existing epidemiological worm models is proposed which is used to simulate the spread of aggressive worms within computer networks. The proposed model presents worm propagation dynamics in five state transitions in a finite state machine model. The results obtained from the simulation are used to compare the dependability of previous worm quarantine models.

Source: An Improved Worm Mitigation Model for Evaluating the Spread of Aggressive Network Worms, C. Onwubiko, A. P. Lenaghan and L. Hebbes.

Entropy Based Worm and Anomaly Detection in Fast IP Networks

An interesting approach to the problem of detecting worm outbreaks using scalable, wide-view network monitoring tools (like NetFlow from border routers). This approach relies on the fact that for any given sliding time window, the traffic seen in that time period will be very self-similar. Because of this, it will compress reasonably well, being highly redundant in nature and all. However, when a large change occurs, like a worm outbreak, the pattern will change, and you can detect this as a change in entropy. While this pinpoints that something happened, it has a bit to go to actually being useful. It's not sufficient to just say "the network has changed," you need to show the operator what changed.

Detecting massive network events like worm outbreaks in fast IP networks, such as Internet backbones, is hard. One problem is that the amount of traffic data does not allow real-time analysis of details. Another problem is that the specific characteristics of these events are not known in advance. There is a need for analysis methods that are real-time capable and can handle large amounts of traffic data. We have developed an entropy-based approach, that determines and reports entropy contents of traffic parameters such as IP addresses. Changes in the entropy content indicate a massive network event. We give analyses on two Internet worms as proof-of-concept. While our primary focus is detection of fast worms, our approach should also be able to detect other network events. We discuss implementation alternatives and give benchmark results. We also show that our approach scales very well.

Source: Entropy Based Worm and Anomaly Detection in Fast IP Networks, Arno Wagner, Bernhard Plattner, both from the Swiss Federal Institute of Technology Zurich.

The Domain Name Service as an IDS The Domain Name Service as an IDS

Kind of a neat way of tracking botnet activity. I wonder if anyone has deployed this operationally and gotten positive results.

SURFnet is looking for technologies to expand the ways they can detect network traffic anomalies like botnets. Since bots started using domain names for connection with their controller, tracking and removing them has become a hard task. This research is a first glance at the usability of DNS traffic and logs for detection of this malicious network activity. Detection of bots is possible by DNS information gathered from the network by placing counters and triggers on specific events in the data analysis. In combination with NetFlow information and IP addresses of known infected systems, detection of bots of network anomalies can be made visible. Also the behavior of a bot can be documented and additional information can be gathering about the bot. Using DNS data as a supplement to the existing detection systems can give more insight in the suspicious network traffic. With some future research, this information can be used to compile a case against particular types of bot or spyware and help dismantling a remote controlled infrastructure as a whole.

Source: The Domain Name Service as an IDS, How DNS can be used for detecting and monitoring badware in a network, Antoine Schonewille, Dirk-Jan van Helmond.

A Self-Learning Worm Using Importance Scanning

Another "smart worm" design paper. I don't think I see many of these sorts of things in the wild, but they're always fun to dream up and try and defend against.

The use of side information by an attacker can help a worm speed up the propagation. This philosophy has been the basis for advanced worm scanning mechanisms such as hitlist scanning, routable scanning, and importance scanning. Some of these scanning methods use information on vulnerable hosts. Such information, however, may not be easy to collect before a worm is released. Questions then arise whether and how a worm can self-learn and use such information while propagating, and how virulent the resulting worm may be. In this paper, we design a self-learning worm using importance scanning. An optimal yet practical importancescanning strategy is derived based on a new metric. A selflearning worm is demonstrated to have the ability to accurately estimate the underlying vulnerable-host distribution if a sufficient number of infected hosts are observed. Experimental results based on parameters chosen from Code Red show that after accurately estimating the distribution of vulnerable hosts, a self-learning worm can spread much faster than a random-scanning worm, a permutation-scanning worm, and a Class A routing worm. Some guidelines for detecting and defending against such self-learning worms are also discussed.

Source: A Self-Learning Worm Using Importance Scanning, Zesheng Chen, Chuanyi Ji.

Botz-4-Sale: Surviving Organized DDoS Attacks That Mimic Flash Crowds

A nice paper on Botnets that attempts to defeat some of their firepower and purpose. I spent much of my available time on Monday looking at a new bot, and it had all sorts of functionality: CD key theft, spam, DDoS of various sorts, proxying, etc ... I don't think that you can simply defeat the DDoS element and call it over with. One of the DDoS mechanisms was to repeat the same URL POST pattern repeatedly, and that's very easy to spot, trace back, and block at the ingress edge. No need to use something like this below, but this paper is still worth a read.

Recent denial of service attacks are mounted by professionals using Botnets of tens of thousands of compromised machines. To circumvent detection, attackers are increasingly moving away from bandwidth floods to attacks that mimic the Web browsing behavior of a large number of clients, and target expensive higher-layer resources such as CPU, database and disk bandwidth. The resulting attacks are hard to defend against using standard techniques, as the malicious requests differ from the legitimate ones in intent but not in content.

We present the design and implementation of Kill-Bots, a kernel extension to protect Web servers against DDoS attacks that masquerade as flash crowds. Kill-Bots provides authentication using graphical tests but is different from other systems that use graphical tests. First, Kill-Bots uses an intermediate stage to identify the IP addresses that ignore the test, and persistently bombard the server with requests despite repeated failures at solving the tests. These machines are bots because their intent is to congest the server. Once these machines are identified, Kill-Bots blocks their requests, turns the graphical tests off, and allows access to legitimate users who are unable or unwilling to solve graphical tests. Second, Kill-Bots sends a test and checks the client's answer without allowing unauthenticated clients access to sockets, TCBs, and worker processes. Thus, it protects the authentication mechanism from being DDoSed. Third, Kill-Bots combines authentication with admission control. As a result, it improves performance, regardless of whether the server overload is caused by DDoS or a true Flash Crowd.

Source: Botz-4-Sale: Surviving Organized DDoS Attacks That Mimic Flash Crowds, Srikanth Kandula, Dina Katabi, Matthias Jacob, Arthur Berger.

Defending against Hitlist Worms using Network Address Space Randomization

I don't think this one is entirely practical, though it was one of the better presentations at WORM05.

Worms are self-replicating malicious programs that represent a major security threat for the Internet, as they can infect and damage a large number of vulnerable hosts at timescales where human responses are unlikely to be effective. Sophisticated worms that use precomputed hitlists of vulnerable targets are especially hard to contain, since they are harder to detect, and spread at rates where even automated defenses may not be able to react in a timely fashion.

This paper examines a new proactive defense mechanism called Network Address Space Randomization (NASR) whose objective is to harden networks specifically against hitlist worms. The idea behind NASR is that hitlist information could be rendered stale if nodes are forced to frequently change their IP addresses. NASR limits or slows down hitlist worms and forces them to exhibit features that make them easier to contain at the perimeter. We explore the design space for NASR and present a prototype implementation as well as preliminary experiments examining the effectiveness and limitations of the approach.

Source: Defending against Hitlist Worms using Network Address Space Randomization, S. Antonatos, P. Akritidis, E. P. Markatos, K. G. Anagnostakis.

Worm propagation strategies in an IPv6 Internet

I like this paper, not only because it dispells a myth but it's also the same line of arguments I've been using for years. Thanks to Ismael for the tip. 

We discuss a number of strategies worms could use in an IPv6-based Internet to find new targets. We separate these into two categories, wide-area and local-area searches, somewhat mirroring the IPv6 address architecture. We argue that worms will use different types of information sources to first determine existing networks and establish a presence there, and then spread locally inside an organization. We hope to illustrate that simple reliance on the IPv6 address space for protection against scanning worms is not a wise defensive strategy, and we suggest areas where research could assist in detecting and limiting future worm propagation.

Source: worm propagation strategies in an IPv6 Internet, Steven M. Bellovin, Bill Cheswick, and Angelos D. Keromytis.

Addressing Malicious SMTP-based Mass-Mailing Activity Within an Enterprise Network

Given all of the recent mass-mailer worm activity, it makes sense to put a paper on dealing with them here.

Malicious mass-mailing activity on the Internet is a serious and continuing threat that includes mass- mailing worms, spam, and phishing. A mechanism commonly used to deliver such malicious mass mail is an SMTP-engine, which turns an infected system into a malicious mail server. We present a technique that enables, in certain network environments, detection and containment of (even zero-day) SMTP-engine based mass-mailing activity within a single mailing attempt. Contrary to other mass- mailing detection techniques our approach is content independent and requires no attachment processing, statistical measures, or system behavioral analysis. It relies strictly on the observation of DNS MX queries within the enterprise network. Our approach can be used as an alternative to port 25 blocking and in conjunction with current proposals to address mass-mailing abuses (e.g. SPF, DomainKeys). Our analysis on network traces from a medium sized university network indicates that MX query activity from client systems is a viable SMTP-engine detection method with a very low false positive rate. Our detection and containment approach has been successfully tested with a prototype using a live mass- mailing worm in an isolated test network.

Source: Addressing Malicious SMTP-based Mass-Mailing Activity Within an Enterprise Network, David Whyte P.C. van Oorschot Evangelos Kranakis.

Modeling Botnet Propagation Using Time Zones

I read this paper the other night while traveling, it's pretty good. It's an early stage analysis, but an interesting finding nonetheless.

Time zones play an important and unexplored role in malware epidemics. To understand how time and location affect malware spread dynamics, we studied botnets, or large coordinated collections of victim machines (zombies) controlled by attackers. Over a six month period we observed dozens of botnets representing millions of victims. We noted diurnal properties in botnet activity, which we suspect occurs because victims turn their computers off at night. Through binary analysis, we also con rmed that some botnets demonstrated a bias in infecting regional populations.

Clearly, computers that are of ine are not infectious, and any regional bias in infections will affect the overall growth of the botnet. We therefore created a diurnal propagation model. The model uses diurnal shaping functions to capture regional variations in online vulnerable populations.

The diurnal model also lets one compare propagation rates for different botnets, and prioritize response. Because of variations in release times and diurnal shaping functions particular to an infection, botnets released later in time may actually surpass other botnets that have an advanced start. Since response times for malware outbreaks is now measured in hours, being able to predict short-term propagation dynamics lets us allocate resources more intelligently. We used empirical data from botnets to evaluate the analytical model.

Modeling Botnet Propagation Using Time Zones, David Dagon, Cliff Zou, Wenke Lee.

The Nyxem Email Virus: Analysis and Inferences

This came out this morning. The amazing finding: 45k of the half million computers (up to about 10%) had other malware easily identifiable on them. Looks like some people can't help but pick up all sorts of crud.

While email viruses and worms are a ubiquitous part of the online environment, Nyxem was relatively rare in that newly infected hosts connect once to a single website, providing a single source of information about the infected population.

Of more critical interest to those infected, the virus also contained a malicious payload designed to overwrite files with certain extensions on the 3rd of every month (beginning February 3, 2006). Affected file types include: .doc, .xls, .mdb, .mde, .ppt, .pps, .zip, .rar, .pdf, .psd, and .dmp.

We estimate that between 469,507 and 946,835 computers in more than 200 countries were infected by the Nyxem virus between January 15 23:40:54 UTC 2006 and Wednesday February 1 05:00:12 UTC. At least 45,401 of the infected computers were also compromised by other forms of spyware or bot software.

Source: The Nyxem Email Virus: Analysis and Inferences, an analysis by David Moore ([email protected]) and Colleen Shannon ([email protected]) of the spread of the Nyxem (or Blackworm or Kama Sutra or MyWife or CME 24) Virus in January and early February 2006.

The Effect of Network Topology on the Spread of Epidemics

This paper is stuffed with math, but don't be afraid to give it a few readings to try and catch what it concludes.

We study the SIS epidemic model (or contact process) on graphs, and identify topological properties of the graph that determine the persistence of epidemics. We show that if the ratio of cure to infection rates is larger than the spectral radius of the graph, then the mean epidemic lifetime is of order log n, where n is the number of nodes. Conversely, if this ratio is smaller than a generalization of the isoperimetric constant of the graph, then the mean epidemic lifetime is of order e^na, for a positive constant a. We apply these results to the hypercube and the star topologies and also to Erdos-Renyi and power law random graphs.

Source: The      Effect of Network Topology on the Spread of Epidemics, Ganesh,      Massoulie, Towsley, IEEE Infocom 2005, Miami,      FL, 2005..

Requirements on Worm Mitigation Technologies in MANETS

Here's sometihng you don't see every day, the idea of a worm loose on a mobile ad hoc network specifically in a battlefield scenario. As communications equipment becomes more linked through data transmission networks, this threat becomes more and more credible.

This study presents an analysis of the impact of mitigation on computer worm propagation in Mobile Ad-hoc Networks (MANETS). According to the recent DARPA BAA - Defense Against Cyber Attacks on MANETS [4], ”One of the most severe cyber threats is expected to be worms with arbitrary payload that can infect and saturate MANET based networks on the order of seconds”. Critical to the design of effective worm counter measures in MANET environments is an understanding of the propagation mechanisms and the performance of the mitigation technologies. This work aims to advance the security of these critical systems through increased knowledge of propagation mechanisms, performance and the effect of mitigation technologies. We present both analytic and simulation analysis of mitigation effectiveness. The ultimate goal of these studies is to develop an accurate set of performance requirements on mitigation techniques to minimize worm propagation in tactical, battlefield MANETS.

Source: Requirements on Worm Mitigation Technologies in MANETS, Robert Cole, Nam Phamdo, Moheeb Rajab, Andreas Terzis. From PADS05.

History: Xerox PARC Worm

A piece of history for everyone. Researchers at Xerox PARC had been experimenting with worms to create a distributed computing environment in their experimental network. This idea worked well until one morning ...  The topic of the Xerox PARC worm came up yesterday during a phone call with someone regarding Dave Aitel's Nematode idea.

The "worm" programs were an experiment in the development of distributed computations: programs that span machine boundaries and also replicate themselves in idle machines. A "worm" is composed of multiple "segments," each running on a different machine. The underlying worm maintenance mechanisms are responsible for maintaining the wormmfinding free machines when needed and replicating the program for each additional segment. These techniques were successfully used to support several real applications, ranging from a simple multimachine test program to a more sophisticated real-time animation system harnessing multiple machines.

Source: The "Worm" Programs Early Experience with a Distributed Computation, John F. Shoch and Jon A. Hupp, Xerox Palo Alto Research Center, 1982.

I cover this worm a bit in my book, but for a nice overall history of Xerox PARC read Dealers of Lightning : Xerox PARC and the Dawn of the Computer Age, by Michael A. Hiltzik.

Epidemic profiles and defense of scale-free networks

Scale-free networks, which have a few nodes highly connected and many nodes weakly connected to the network, are both a boon for networks and a bane for defending against autonomously propagating malware. Once a well connected node is hit, it can quickly infect all nodes on the network. For some good background on the effects of this phenomenon on networks carrying a contagen, look at Mark Newman's work.

In this paper, we study the defensibility of large scale-free networks against malicious rapidly self-propagating code such as worms and viruses. We develop a framework to investigate the profiles of such code as it infects a large network. Based on these profiles and large-scale network percolation studies, we investigate features of networks that render them more or less defensible against worms. However, we wish to preserve mission-relevant features of the network, such as basic connectivity and resilience to normal nonmalicious outages. We aim to develop methods to help design networks that preserve critical functionality and enable more effective defenses.

Source: Epidemic profiles and defense of scale-free networks, Linda Briesemeister, Patrick Lincoln, and Phillip Porras. In Proceedings of the 2003 ACM Workshop on Rapid Malcode (WORM).

Microscopic simulation of a group defense strategy

Another paper on modeling from the SRI group, this one is a good complement to the one from a few days ago. And, it focuses on looking at the effects of quarantine in a model.

We introduce a novel worm containment strategy that integrates two complementary worm quarantine techniques. The two techniques are linked, with one strategy employing the other as an indicator of worm infection. A group defense mechanism shares such indicators among neighboring networks, and when enough corroboration occurs, the network engages in traffic filtering to halt infection attempts.

We present an SSFnet-based microscopic simulation of the containment strategy against random scan worms, and explore various performance characteristics of the group defense mechanism. The simulation results help to characterize the conditions and degree to which the integrated quarantine strategy can both slow worm propagation and prevent the worm from reaching its full saturation potential.

Source: icroscopic simulation of a group defense strategy, Linda Briesemeister and Phillip Porras. In Proceedings of Workshop on Principles of Advanced and Distributed Simulation (PADS), pages 254-261, June 2005.

Model checking of worm quarantine and counter-quarantine under a group defense

This is a lengthy, formal paper, but quite intriguing. So far I think the research is sound and the methodology proposed is interesting, but I don't know how well it would work in the real world. But perhaps within an enterprise ... Nonetheless, if you're feeling like reading a strong academic paper, here is one for you.

We consider what it means to perform worm quarantine across a network with an emerging self-propagating worm outbreak. It is generally understood that an effective quarantine defense can under certain conditions reduce the infection growth rate, and ideally can prevent a worm from reaching its full saturation potential. This report attempts to more precisely define the desired properties of a quarantine algorithm, and suggest different forms of quarantine properties that vary in their ability to isolate infected nodes, ensure the existence of an uninfected population, and guarantee some persistent protection, no matter how the worm behaves. We employ the SAL formal modeling language and model checker to investigate these properties on a specific group-based quarantine algorithm. In addition to answering questions regarding algorithm correctness and validating some quarantine properties, the model checker disproves other quarantine properties. The proofs and counter-examples produced during this process help in algorithm design and may be useful in informing simulation experiments or building test cases. Using a game theoretic approach, counter-examples of a win scenario for the defense yield insight into smart worm behavior that defeats a known quarantine defense.

Source: Model Checking of Worm Quarantine and Counter-Quarantine under a Group Defense,  by Linda Briesemeister, Phillip A. Porras and Ashish Tiwari.  Publication number SRI-CSL-2005-03. Computer Science Laboratory, SRI International, Menlo Park, CA. October, 2005.

Malware – future trends

Another paper looking at the worst case scenario of the future for malware, specifically bots and worms. I saw this last week but have been so busy with worth that I haven't had a chance to write up my thoughts on it.

Malware has truly evolved during the last couple of years. Its potential for financial and network based abuse was quickly realized, and thus, tactics changed, consolidation between different parties occurred, and the malware scene became overly monetized, with its services available on demand.

What are the driving forces behind the rise of malware? Who’s behind it, and what tactics do they use? How are vendors responding, and what should organizations, researchers, and end users keep in mind for the upcoming future? These and many other questions will be discussed in this article, combining security experience, business logic, a little bit of psychology, market trends, and personal chats with knowledgeable folks from the industry.

Source: Malware – Future Trends, by Dancho Danchev.

Some comments on the paper. First, much of the analysis is decent, and it brings together a number of pieces from disparate reports. Some of those reports rae vendor reports, and some vendors are happier than others to sound dire, but the paper does bring together some statistics to gain a view of the trends.

I think that many of the parts of section 4, The current state of the malware threat, are true, but a few are oversimplified. Linux malware is still seen, look at threats like Santy and Kaiten, and the Mechwarrior bot.

But more importantly, I think that some of the parts of part 6, Future trends, are not going to come true, at least as they may appear here. Ransomware, for instance, is hard to manage on a large scalem and would have been well to leave out of this paper. You'd have to hire staff and manage problems on a large scale to make this effective or efficient. Never mind the fact that all that work makes it easier to trace the malware controllers. Ad rveenue hijacking is already occurring, and has been found in all of the major online marketing services. The future is already here, I guess. Same for botnets, and I expect that we'll see more evasive botnet communication channels in the future. But right now, that's not a real problem. We don't see many botnet detection mechanisms relying on traffic signatures, and it's already possible to track bots via their servers and their software, making it less important to track them via traffic signatures, and therefore there is less pressure to evade such detection. Access is typically controlled via server keys, channels keys and passwords, piggybacking on the IRC protocol, not via strong cryptography. After all, the good guys hate managing keys, why wouldn't the bad guys?

Clearly I don't hold a crystal ball, and my perceptions on this paper and this field are going to be as fallable as anyone else's. But, this is where I see some flaws in this paper. It's a good read, but I don't think it is entirely true ...

An API for worm-defense evaluation

It's been a while since I've posted a regular academic paper on worm outbreak simulations. This paper covers a methodology to rapidly deploy new simulation runs and evaluate defense proposals. More about the methodology than the results, but interesting nonetheless. From the introduction of the paper:

Thus there is a great need for a way to faithfully reproduce live environments for worm- and worm-defense research. In this paper we make use of a network testbed called EMULAB[1] to satisfy this need and evaluate our framework for worm-defense evaluation within enterprise networks, i.e., networks with a few tens to few thousands of nodes. We describe an implementation of the framework and use it to evaluate an example defense strategy, but emphasize that the framework can support many different defense strategies. The framework is encapsulated in an API. This API accepts a topology description and a description of the defense system, and evaluates the defense system against worms. The worms can be characterized by a specification or operationally by a worm program.

Source: An API for worm-defense evaluation, Senthilkumar G Cheetancheri, Denys Ma, Todd Heberlien, Karl Levitt.

VX reversing II, sasser B

The Sasser worm from May of 2004 provides an excellent example of modern malware in a reverse engineering setting. Eduardo Labir's article for the CodeBreakers Journal is a nice tutorial on how to really get into code, analyze it, and understand what is going on.

Tools you'll want to have handy: VMware, so that you don't trash your main machine (another throwaway machine may also be used, but a virtual system is most often a handy way to keep the number of physical machines down); OllyDbg, a (free) 32-bit debugger with plenty of nice features; and IDApro, one of the best disassembler tools I can find (it's commercial, and sometimes the HT editor can do in a pinch).

The well known worm Sasser has been one of the viruses which has received more attention in the press in the latest months. It's author, an 18 years old student from Germany, after causing lots of troubles to many home users and small enterprises faces up to several years of prison. Sasser is not a well programmed virus, it's success is entirely due to the exploit it implements, which was announced by Microsoft in one of their security bulletins. In this paper, we will reverse Sasser.B - the second of its variants - showing how it works and also how to clean your computer after infection.

Source: VX reversing II, sasser B, Eduardo Labir, in the CodeBreakers Journal. Eduardo also has a nice piece entitled VX reversing I, The Basics where you may want to begin if this is new to you.

Internet Worms: Walking on Unstable Ground

Another "it could get much worse" kind of thing, this one is a SANS practical.

Each day, worms are becoming a more common occurrence on the Internet. As the incidents increase, we must be thinking proactively in order to lessen the negative effects these worms have on the Internet community. It is important to remember that the livelihood of many businesses is based on an Internet presence.

The monetary losses incurred by businesses relating to these worms are hard to measure. Some estimate losses for each occurrence to be around $1 billion. 1 The true value of damages may never be known. Many companies prefer not to publicly report losses since they do not want to diminish customer confidence in their services.

So far, we have been lucky. There has not been a worm that caused widespread permanent damage to computers. Everything we have seen so far has been related to some sort of denial of service. In order to prepare for the future, we need to be thinking ahead to beat worm writers before they release the next worm onto the Internet. The worms we have seen so far have been fairly sloppy. Most propagate slowly, giving system administrators a chance to catch up on their security practices prior to any major damage taking place.

Source: Internet Worms: Walking on Unstable Ground, by Jon Maurer.

Bot Software Spreads, Causes New Worries

2005 has definitely been the year of the bot, bigger and badder than any other year. And since a bot's often delivered by a worm, it fits here, too. Been up to my neck in WMF associated malware the past couple of days, but nothing I saw was a worm (it was all manually driven).

Zombies attack! Bot software sounds a bit like a low-budget horror movie, but it's quietly making trouble and stealing data right now, using millions of PCs worldwide. These malicious pieces of code, often compared to an undercover army of robots, invade a PC and use its computing power to do someone else's dirty work most often without the PC owner's knowledge.

The infected PC, known as a zombie, becomes another node on a bot network, typically 2,000 to 10,000 PCs strong, according to Symantec. Unfortunately, a bot network proves a practical tool for people who want to spread PC viruses and worms, send spam emails, install spyware on PCs, or carry out denial-of-service attacks on particular Web sites.

Technology publications have been buzzing about the bot threat ever since a flavor called Agobot took a fast ride through the Internet in April, finding its way into PCs thanks to a Windows operating system vulnerability. Security experts warn that large networks of Agobot-infected PCs now sit at the ready, waiting for directions. Have the risks been overblown, or do bots deserve special scrutiny?

Source: Bot Software Spreads, Causes New Worries, by Laurianne McLaughlin, in IEEE DISTRIBUTED SYSTEMS ONLINE 1541-4922 © 2004 Published by the IEEE Computer Society, Vol. 5, No. 6; June 2004.

Indirect Detection of Mass Mailing Worm-Infected PC terminals for Learners

I've posted about mass-mailer detection using DNS queries before, and it still strikes me as a very efficient and elegant way to detect many mass-mailers on a typical enterprise network. Does anyone here have any pointers to any DNS monitoring tools or patches to BIND that they like for this sort of thing?

We have developed a new indirect virus detection system that detects IP addresses of the mass mailing worm (MMW)-infected PCterminals for learners by only watching the domain name system (DNS) query traffic between the DNS server and the PC terminals.

Indirect Detection of Mass Mailing Worm-Infected PC terminals for Learners, Yasuo Musashi, Ryuichi Matsuba, and Kenichi Sugitani.

Spatial-Temporal Modeling of Malware Propagation in Networks

Some more modeling. I like these sorts of papers because I can chew on them for a while, they don't make sense right away. And with those sorts of things, you walk away learning a lot.

—Network security is an important task of network management. One threat to network security is malware (malicious software) propagation. One type of malware is called topological scanning that spreads based on topology information. The focus of this work is on modeling the spread of topological malwares, which is important for understanding their potential damages, and for developing countermeasures to protect the network infrastructure. Our model is motivated by probabilistic graphs, which have been widely investigated in machine learning. We first use a graphical representation to abstract the propagation of malwares that employ different scanning methods. We then use a spatial-temporal random process to describe the statistical dependence of malware propagation in arbitrary topologies. As the spatial dependence is particularly difficult to characterize, the problem becomes how to use simple (i.e., biased) models to approximate the spatially dependent process. In particular, we propose the independent model and the Markov model as simple approximations. We conduct both theoretical analysis and extensive simulations on large networks using both real measurements and synthesized topologies to test the performance of the proposed models. Our results show that the independent model can capture temporal dependence and detailed topology information, and thus outperforms the previous models, whereas the Markov model incorporates a certain spatial dependence and thus achieves a greater accuracy in characterizing both transient and equilibrium behaviors of malware propagation.

Source: Spatial-Temporal Modeling of Malware Propagation in Networks, Zesheng Chen, Student Member, and Chuanyi Ji.

Computer Parasitology

A paper from Symantec that serves as a nice history of worms pre-2001 or so, and highlights some of the struggles that came true (and are still with us).

Computer worms will pose the greatest threat to both consumer and corporate computer systems over the next decade. As we will see, they will change the nature of anti-virus (anti-malware?) software and require paradigm shifts in enterprise security and infrastructurei. This paper will cover the past, present and future of computer worms, attempt to provide IT professionals with an understanding of how and why these threats spread, and offer some insight into the nature of future anti-worm solutions and worm-resistant corporate infrastructures that can be leveraged to protect the enterprise from these threats.

Source: Computer Parasitology, Carey Nachenberg from the Symantec AntiVirus Research Center.

Call for Papers: Journal of Computer Virology

This hit the Bugtraq list earlier today, and may be of interest to wormblog readers and researchers. As for me, I don't know if I'll be submitting anything.

The Journal of Computer Virology invites authors to discuss the state of the art of malware and anti-malware technologies and security issues for mobile environments. Authors are invited to submit full technical papers of up to 25 pages presenting novel and mature research results. Papers will be reviewed and papers accepted will be published in a Special Issue of the Journal in Computer Virology.

The scope of this special issue includes, but is not limited to the following topics:*

• Viruses, worms, trojans and spyware (malicious codes threats).
• Antiviral techniques.
• System and network security.
• Software security.
• Software implementation security.
• PDA, smartphone and mobile device security.
• Wi-Fi/WLAN/Bluetooth security
• Reverse engineering.
• Cryptography and cryptanalysis.
• Mobile forensics and law-enforcement.
• Security policies.

Important dates

Submission deadline: March 15, 2006.
Notification of acceptance: June 15, 2006.

Some links:

Journal in Computer Virology at SpringerLink.
Call for papers on the Mobile Antivirus Researchers Association website.

Win32/Blaster: A Case Study From Microsoft's Perspective

The Blaster worm is back, and bigger and badder than ever! No, not really, but lots of press about it lately. Most of it is centered around a paper from Microsoft that appeared a VBConf 2005 recently.

On August 11, 2003, the world of mobile malicious code changed with the release of the Blaster worm. Using a vulnerability in the Microsoft Windows 2000 and Windows XP operating systems to infect a computer, the threat replicated to more computer systems than any other malicious software in history.

Since the release of Blaster almost two years ago, Microsoft has invested considerable resources in reducing the number of users infected with this threat, in addition to putting mechanisms in place to help prevent the class of vulnerability that Blaster exploited.

This white paper provides deeply quantitative details and statistics that Microsoft has observed regarding the initial and continued effects of the worm on the global computing infrastructure and Internet users worldwide.

This white paper was originally presented at the 2005 Virus Bulletin Conference in Dublin, Ireland, on October 7, 2005.

Source: Win32/Blaster: A Case Study From Microsoft's Perspective, Matthew Braverman.

The followup press has been pretty interesting, too. See the following:

• MSBlast infected more than 25 million, posted on SecurityFocus.
• Two Years Later, Blaster Worm Still Squirming, by Ryan Naraine.

Analysis and Comments

I think the most telling piece is Table 3 in the Microsoft paper, namely how different kinds of malware identified and removed by Microsoft has been found in different Windows XP versions. Remember that XP Gold is the original version of XP, and that XP SP2 introduced a number of security fixes that prevent worms like Blaster from spreading. The most striking things about that table are twofold. First, XP SP2 has had a real impact on malware on Windows, which was one of the major goals of the project. You cannot ignore that fact. Secondly, not all kinds of malware are equally affected, namely Trojans and user-loaded (by hook or by crook) malware seems unaffected by XP SP2. Microsoft has a long way to go to stopping such attacks.

And finally, in that eWeek piece by Ryan, I had sworn I had said "It's not surprising that MS is removing hundreds of copies a day". In all of our studies we have always been about 10-fold below what Microsoft had said was Blaster's population. But, I can't say I'm that surprised by the number of "800 a day", given the numbers we measured.

Thanks to RL and RN for their heads up on the follow up articles to this paper.

Cooperative Automated worm Response and Detection ImmuNe ALgorithm (CARDINAL) inspired by T-cell Immunity and Tolerance

This kind of approach, biologically inspired, is definitely the kind of thing that I like. Self-learning and regulating systems are, I think, an interesting challenge to solve and a promising avenue of defense.

The role of T-cells within the immune system is to confirm and assess anomalous situations and then either respond to or tolerate the source of the effect. To illustrate how these mechanisms can be harnessed to solve real-world problems, we present the blueprint of a T-cell inspired algorithm for computer security worm detection. We show how the three central T-cell processes, namely T-cell maturation, differentiation and proliferation, naturally map into this domain and further illustrate how such an algorithm fits into a complete immune inspired computer security system and framework.

Source: Cooperative Automated worm Response and Detection ImmuNe ALgorithm (CARDINAL) inspired by T-cell Immunity and Tolerance, Jungwon Kim, William O. Wilson, Uwe Aickelin and Julie McLeod.

A Two-Layer Approach for Novel Email Worm Detection

We don't cover enough mass-mailer detection on wormblog. A pretty simple approach, and one that seems to have some merit.

The rapid proliferation of novel email-borne worms poses new challenges for systems administrators. Traditional techniques for scanning email messages for viruses rely on up-to-date virus signatures. However, these signatures are primarily manually generated, can only be created after a sample of a virus has been received and identified by an antivirus company, and must be disseminated to each virus scanner. This process can take anywhere from hours to days to complete, an insufficient amount of time to prevent epidemics for rapidly propagating viruses. In this paper, we propose and evaluate an approach for catching such infections quickly. We combine sensitive novelty detection with a parametric classifier for increased accuracy. We provide preliminary results for six separate email-borne viruses with varying characteristics.

Source: A Two-Layer Approach for Novel Email Worm Detection, Steve Martin Anil Sewani Blaine Nelson, Karl Chen Anthony D. Joseph.

Malware Defense Using Network Security Authentication

This paper looks a lot like two network control initiatives, Microsoft's NAP and Cisco's NAC. Howver, the authors clearly give out some more information on how it works. Yet, the approach is still fraught with problems, namely the fact that you cannot determine intent from a simple entrance qualification. Once on the network, you have to keep monitoring hosts. I do think it's part of a solution, though. You wouldn't let cars unfit for the road onto a highway, so why should you let arbitrary hosts onto the network?

Malware defenses have primarily relied upon intrusion fingerprints to detect suspicious network behavior. While effective for discovering computers that are already compromised, these systems are not designed to stop the spread or damage of malware. Standard gateway firewalls can prevent outside-based attacks; however, they are ineffective in a mobile network where threats originate from inside and administrators have limited control over client machines.

This paper introduces a new strategy for malware defense using security authentication which focuses on vulnerabilities rather than exploits. The proposed system uses a remote security scanner to check for vulnerabilities and quarantines machines using logical network segmentation. This maximizes the usefulness of the machine in question while preventing attacks. Furthermore given the unique ability to quarantine machines without any specialized host software, the proposed system can defend against internal malware threats in a mobile network. Positive results have been achieved utilizing a proof-of-concept model and standard networking tools.

Source: Malware Defense Using Network Security Authentication, Joseph V. Antrosio and Errin W. Fulp.

Protocol-Independent Adaptive Replay of Application Dialog

This is an incredibly cool development, one that I've wanted for a few years but never fully knew how to build. I'm glad to see it's been done, and honestly I figured Paxson would have been involved.

For many applications—including recognizing malware variants, determining the range of system versions vulnerable to a given attack, testing defense mechanisms, and filtering multi-step attacks—it can be highly useful to mimic an existing system while interacting with a live host on the network. We present RolePlayer, a system which, given examples of an application session, can mimic both the client side and the server side of the session for a wide variety of application protocols. A key property of RolePlayer is that it operates in an application-independent fashion: the system does not require any specifics about the particular application it mimics. It instead uses byte-stream alignment algorithms to compare different instances of a session to determine which fields it must change to successfully replay one side of the session. Drawing only on knowledge of a few low-level syntactic conventions (such as representing IP addresses using “dotted quads”), and contextual information such as the domain names of the participating hosts, RolePlayer can heuristically detect and adjust network addresses, ports, cookies, and length fields embedded within the session, including sessions that span multiple, concurrent connections on dynamically assigned ports.

We have successfully used RolePlayer to replay both the client and server sides for a variety of network applications, including NFS, FTP, and CIFS/SMB file transfers, as well as the multi-stage infection processes of the Blaster and W32.Randex.D worms.

Source: Protocol-Independent Adaptive Replay of Application Dialog, Weidong Cui, Vern Paxson, Nicholas C. Weaver, Randy H. Katz.

A Hybrid Quarantine Defense

Since I'm at WORM05 today, I figured I'd post a paper from WORM04. Having worked on a quarantine approach in a commercial solution, it's interesting to me to look at other approaches. This one, as the title suggests, combines approaches and models the results. An interesting study, although a shorter paper.

We study the strengths, weaknesses, and potential synergies of two complementary worm quarantine defense strategies under various worm attack profiles. We observe their abilities to delay or suppress infection growth rates under two propagation techniques and three scan rates, and explore the potential synergies in combining these two complementary quarantine strategies. We compare the performance of the individual strategies against a hybrid combination strategy, and conclude that the hybrid strategy yields substantial performance improvements, beyond what either technique provides independently. This result offers potential new directions in hybrid quarantine defenses.

Source: A Hybrid Quarantine Defense, Phillip Porras, Linda Briesemeister, Keith Skinner, Karl Levitt, Jeff Rowe, Yu-Cheng Allen Ting.

Preliminary Results Using ScaleDown to Explore Worm Dynamics

Another paper on modeling worm propagation, this one is very short and focused. Not nearly as daunting (in the quantity of equations) as some of the previous days' posts.

A major challenge when attempting to analyze and model large-scale Internet phenomena such as the dynamics of global worm propagation is finding appropriate abstractions that allow us to tractably grapple with size of the artifact while still capturing its most salient properties.We present initial results from investigating “scaledown” techniques for approximating global Internet worm dynamics by shrinking the effective size of the network under study.We explore scaledown in the context of both simulation and analysis, using as a calibration touchstone an attempt to reproduce the empirically observed behavior of the Slammer worm, which exhibited a peculiar decline in average per-worm scanning rate not seen in other worms (except for the later Witty worm, which exhibited similar propagation dynamics). We develop a series of abstract models approximating Slammer’s Internet propagation and demonstrate that such modeling appears to require incorporating both heterogeneous clustering of infectibles and heterogeneous access-link bandwidths connecting those clusters to the Internet core. We demonstrate the viability of scaledown but also explore two important artifacts it introduces: heightened variability of results, and biasing the worm towards earlier propagation.

Source: Preliminary Results Using ScaleDown to Explore Worm Dynamics, Weaver, Hamadeh, Kesidis, Paxson, from ACM CCS WORM, Oct 2004.

On the Race of Worms, Alerts and Patches

This paper, while math heavy (something like 65 or more equations), models the interplay between worm propagation and patching. Some heavy stuff, but study it closely. It's good work, and one of the more important studies I've seen on this question.

We study the efficacy of patching and filtering countermeasures in protecting a network against scanning worms. Recent work has addressed the question of detect- ing worm scans and generating self-certifying alerts, specif- ically in order to combat zero-day worms. Alerts need to be propagated in the network, and this is typically done us- ing an overlay of dedicated servers. Alerted servers are used for filtering worm traffic and for generating and distributing patches to end hosts within their subnet. Can alerts and patches be propagated fast enough to limit the spread of the worm? The answer will depend on the speeds of the different processes, namely, worm spread, alert spread, and downloading of patches from servers. We characterize the interplay between them and establish fundamental limits on the effectiveness of these countermeasures. Specifically, we show that (i) the number of nodes eventually infected grows approximately exponentially in the ratio of infection rate to patch rate, and (ii) the patch rate required to ensure a bound on the final number of infectives grows only loga- rithmically with the number of servers in the overlay. (iii) We introduce the concept of minimum broadcast curve as an abstraction of the alert dissemination process on over- lays, which unifies the analytical treatment of a variety of overlay networks. The results provide engineering guide- lines for the design of alert propagation and patching sys- tems. In particular, they specify the required frequency of automatic updates, and suggest that automatic patching is feasible provided that scan rates are limited to reasonable values. The results are obtained analytically, supplemented by simulations. The simulations demonstrate the accuracy of the analytical framework established in this paper.

Source: On the Race of Worms, Alerts, and Patches, Milan Vojnovic and Ayalvadi Ganesh, MSR Technical Report MSR-TR-2005-13, Feb 2005.

Can a Network be Protected from Single-Packet Warhol Worms?

Given the recent back and forth debate over the wormability of a recent Snort bug (single UDP packet, a'la Witty), this paper couldn't be more timely.

Can a network be protected from single-packet Warhol worms? This paper generates and simulates random network environments to answer that question. The research assumes a perfect detection algorithm and varies the time required to perform the identification. Perfect detection alone is not sufficient; it must also be swift in recognizing threats as some cases presented here show that perfect detection offers no noticeable protection. The impact of other network factors on worm propagation and prevention are investigated as well, including: router participation in the prevention scheme, the percentage of routers involved in the traffic passing, and the ability for participating routers to communicate. The results are promising: realistic simulations without communication can protect over 50% of the network. The addition of communication increases that protection to over 80%. The key result is that emerging identification technologies such as LeBrea can be leveraged into viable automated network protection systems against single-packet worms.

Source: Can a Network be Protected from Single-Packet Warhol Worms?, Larry G. Irwin II & Richard J. Enbody.

Semi-Supervised Learning on Email Characteristics for Novel Worm Detection

Posts have been a little erratic lately, exhaustion is setting in. Thanks for your continued patronage.

You know me, I love novel detection methods, and mass-mailers are always interesting in some fashion. The good news is that there's never a shortage of them.

A major drawback of unsupervised learning for worm detection is the possibility of false negatives. Previous work copes with this problem by increasing the sensitivity of the unsupervised classification algorithms. This, in turn, creates many more false positives. Our focus is narrowed to worms propagating through email.

We present the following contributions. First, we examine a wide range of features calculated on email traffic to determine indicators that discriminate between infected from normal email behavior. Using these features, we next present a new method that uses semi-supervised learning for adaptive virus detection that leverages system administrator feedback to improve classification. Our approach combines the strengths of sensitive novelty detection with a parametric classifier to drastically reduce the false positives.

Source: Semi-Supervised Learning on Email Characteristics for Novel Worm Detection, Steve Martin and Anil Sewani.

Active Technologies to Contain Internet Worm

An interesting paper, in some ways stating a conclusion that we have accepted as convention, but the approach is still hindered by false positives. Cutting off traffic automatically is always a scary proposition in a live, production network.

Most of researches focus on modeling and detection of the Internet worm propagation, but in practice, the final objects are containment and elimination of Internet worm, which have not received enough research effects. In this paper, three categories of active technologies to contain Internet worm were introduced: vaccination for containing susceptible machines, forcing shutdown for containing infected machines, and bidirectional leading for containing worm spreading traffic. These technologies can be adopted to construct one or more automated Internet worm defense systems in any phase of Internet worm defense: prevention, detection, containment and elimination. Our experiment in large scale network shows that when combined with those active technologies, automated Internet worm defense systems are more effective to contain the Internet worm and to shorten the defense time.

Source: Active Technologies to Contain Internet Worm, Hui Zheng, Haixin Duan.

A Cooperative Immunization System for an Untrusting Internet

This is another paper on cooperative detection techniques. This sort of thing has been mentioned before, basically you have an information sharing network that automates much of what humans would do to qualify the emergence of a worm as a global threat or not. One of the possible problems, if the system isn't done right, is that you miss an early part of a worm. A number of other potential problems are inherent in this sort of system without the right level of information sharing, although the idea is useful nonetheless.

Viruses and worms are one of the most common causes of security problems in computer systems today. Users attempt to protect machines from such attacks by using antivirus programs and firewalls, with a mixed record of success at best. One of the main problems with these solutions is that they rely on manual configurations and human intervention, and may fail to react in time to defend against an attack.

We present a cooperative immunization system that helps defend against these types of attacks. The nodes in our system cooperate and inform each other of ongoing attacks and the actions necessary to defend. To evaluate our proposal, we discuss a simple virus model and evaluate our system using simulation. Our measurements show that our algorithm is more effective against viruses and more robust against malicious participants in the immunization system.

Source: A Cooperative Immunization System for an Untrusting Internet, Kostas G. Anagnostakis, Michael B. Greenwald, Sotiris Ioannidis, Angelos D. Keromytis, Dekai Li.

Bots and botnets – risks, issues and prevention

A paper which serves as a great introduction to the growing threat of botnets. If you've been curious as to their early history and likely trajectory, this is a great paper to read. Especially in light of recent botnet arrests.

Many corporate security staff have a rather vague understanding of bots and botnets – not just what they are but how they work. Furthermore, many have little understanding of the risks to their company or to their own home computer.

In many institutions and corporations bots and botnets are rife and causing significant damage to the infected network owner, due to loss of bandwidth, intellectual property and reputation; loss of credibility and brand damage.

This paper will explain what bots/botnets are and how they work. It will also discuss ways to combat them using methods that range from simple security methodologies through to technical solutions.

Source: Bots and botnets – risks, issues and prevention, Martin Overton. This paper appeared at the Virus Bulletin Conference 2005.

SweetBait: Zero-Hour Worm Detection and Containment Using Honeypots

The goals of this project sound an awful lot like the Honeycomb project. Very interesting ...

As next-generation computer worms may spread within minutes to million of hosts, protection via human intervention is no longer an option. We discuss the implementation of SweetBait, an automated protection system that employs low-interaction honeypots to capture suspicious trafic. After discarding whitelisted patterns, it automatically generates worm signatures. To provide a low response time, the signatures may be immediately distributed to network intrusion detection and prevention systems. At the same time the signatures are continuously refined for increased accuracy and lower false identification rates. By monitoring signature activity and predicting ascending or descending trends in worm virulence, we are able to sort signatures in order of urgency.  As a result, the set of signatures to be monitored or filtered is managed in such a way that new and very active worms are always included in the set, while the size of the set is bounded. SweetBait is deployed on medium sized academic networks across the world and is able to react to zero-day worms within minutes. Furthermore, we demonstrate how globally sharing signatures can help immunise parts of the Internet.

Source: SweetBait: Zero-Hour Worm Detection and Containment Using Honeypots, Georgios Portokalidis and Herbert Bos.

Polymorphic Worm Detection Using Structural Information of Executables

Another interesting technique to look for polymorphic worms and attacks. I wonder how scalable this will be, though, without requiring massive investments in hardware.

This paper presents a novel technique based on the structural analysis of binary code that allows one to identify structural similarities between different worm mutations. The approach is based on the analysis of a worm's control flow graph and introduces an original graph coloring technique that supports a more precise characterization of the worm's structure. The technique has been used as a basis to implement a worm detection system that is resilient to many of the mechanisms used to evade approaches based on instruction sequences only.

Source: Polymorphic Worm Detection Using Structural Information of Executables, Christopher Kruegel, Engin Kirda, Darren Mutz, William Robertson, and Giovanni Vigna.

ARP-based Detection of Scanning Worms Within an Enterprise Network

This is a very similar approach to the DIB:S approach, basically listening for blooms of activity indictaing failed connection attempts. This one only works on a single broadcast segment, so you'd have to instrument your network significantly to make this work.

Rapidly propagating worms are arguably the greatest security threat currently facing the Internet. To date, worm writers have been successful in penetrating most security countermeasures. Signature-based detection schemes often fail to detect zero-day worms, and their ability to rapidly react to new threats is limited as they typically require some form of human involvement to formulate updated attack signatures. We propose an anomaly-based detection technique designed to protect internal networks from scanning worm infections. This is the first publication in the open literature (to our knowledge) proposing and providing a detailed description of a method to detect propagation of scanning worms within individual network cells. We show that this technique is both accurate and rapid enough to enable automatic containment and suppression of worm propagation within a network cell. Implemented in software, our detection approach relies on an aggregate anomaly score, derived from the correlation of Address Resolution Protocol (ARP) activity from individual network attached devices. Our preliminary analysis and prototype indicate that this technique can be used to rapidly detect zero-day worms within a very small number of scans, e.g. three scans with a false positive rate of five over a two week period in our test environment. The necessary individual ARP activity system profiles are automatically generated during a training period and thus the software can be rapidly deployed with minimal tuning and administration.

Source: ARP-based Detection of Scanning Worms Within an Enterprise Network, David Whyte, P.C. van Oorschot, Evangelos Kranakis.

A Closer Look at the Worm_Mimail.A

While Mimail started appearing in mid-2003, many of the same techniques you see used in that are common in many mass mailers. This analysis is a bit cursory, but reveals how these things work.

On August 1, 2003, I encountered several emails from my email admin account informing me that my email address will be expiring and that I should read an attachment for further details. Being suspicious, I analyzed that file and the affects of it. This is a short overview of what I have found so far.

Source: A Closer Look at the Worm_Mimail.A  by  Charles Hornat.

Early Detection of BGP Instabilities Resulting from Internet Worm Attacks

This is an interesting proposal, but I'm not sure that routing disruptions are the right place to detect the spread of a worm. After all, the preceeding days' worth of posts showed how large the routing disruptions can be, but there's always some BGP disruption that is going on. What's more, only a small number of worms have truly impacted BGP routing tables.

The increasing incidences of worm attacks in the Internet and the resulting instabilities in the global routing properties of the Border Gateway Protocol (BGP) routers pose a serious threat to the connectivity and the ability of the Internet to deliver data correctly. In this paper we propose a mechanism to detect/predict the onset of such instabilities which can then enable the timely execution of preventive strategies in order to minimize the damage caused by the worm. Our technique is based on online statistical methods relying on sequential change-point and persistence filter based detection algorithms. Our technique is validated using a year's worth of real traces collected from BGP routers in the Internet that we use to detect/predict the global routing instabilities corresponding to the Code Red II, Nimda and SQL Slammer worms.

Source: Early Detection of BGP Instabilities Resulting from Internet Worm Attacks, S. Deshpande,  M. Thottan, B. Sikdar.

Importance-Scanning Worm Using Vulnerable-Host Distribution

This is a short paper (only 6 pages), but it brings up an interesting approach backed by game theory.

Most Internet worms use random scanning. The distribution of vulnerable hosts on the Internet, however, is highly non-uniform over the IP-address space. This implies that random scanning wastes many scans on invulnerable addresses, and more virulent scanning schemes may take advantage of the non-uniformity of a vulnerable-host distribution. Questions then arise how attackers may make use of such information, and how virulent the resulting worm may be. These issues provide “worst-case scenarios” for defenders and “best-case scenarios” for attackers if the vulnerable-host distribution is available. This work develops such a scenario as the so-called importance scanning. Importance scanning results from Importance Sampling in statistics that scans IP-address space according to an empirical distribution of vulnerable hosts. An analytical model is developed to relate the infection rate of worms with the importance scanning strategies. Experimental results based on parameters chosen from Code Red and Slammer worms show that an importance-scanning worm can spread much faster than both a random-scanning worm and a routing worm. Furthermore, a game-theory approach suggests that the best strategy for defenders is to scatter applications uniformly in the entire IP address space.

Source: Importance-Scanning Worm Using Vulnerable-Host Distribution, Zesheng Chen and Chuanyi Ji.

The Evolution of Malicious Agents

I enjoy studying history, mainly because it helps you understand where you may find things heading in the near term. This paper is no different.

In the context of this paper, a malicious agent is a computer program that operates on behalf of a potential intruder to aid in attacking a system or network. Historically, an arsenal of such agents consisted of viruses, worms, and trojanized programs. By combining key features of these agents, attackers are now able to create software that poses a serious threat even to organizations that fortify their network perimeter with firewalls.

This paper examines the evolution of malicious agents by first looking at replication and propagation mechanisms of programs such as the Morris Worm and the Melissa Virus. These programs are effective for illustrating the rate at which malicious agents can spread, as well as for demonstrating the ease with which they are able to penetrate the organization's network defenses.

Next, the paper discusses spying viruses such as Caligula, Marker and Groov, which, after infecting a computer system, report their findings to the home base. These viruses are limited in that their behavior has to be programmed in advance. However, they are especially dangerous because they utilize outbound connections to communicate with their authors, and can be used as powerful reconnaissance scanners. Because many firewall policies do not restrict outbound traffic such as HTTP and FTP, these viruses are able to stay in contact with their authors even when operating in an organization that considers itself secured from the outside.

The paper proceeds by analyzing features and limitations of remotely controlled agents such as Back Orifice and NetBus, as well as of distributed denial-of-service software such as Trinoo and TFN. These programs can provide attackers with the ability to remotely issue commands on the infected machine. In addition, distributed denial-of-service programs have the ability to coordinate actions of multiple agents, providing their operators with multiple attack launching points. However, current versions of these programs do not have propagation capabilities of viruses and worms, and are effectively prevented from accepting commands from the operator by most firewalls because the controlling traffic is primarily inbound.

Finally, the paper details the possibility of a new breed of malicious agents that combine propagation capabilities of old-fashioned viruses and worms with the interactivity of remotely controlled agents by using outbound traffic to obtain instructions. In particular, the paper focuses on the RingZero trojan, as an example of an existing malicious agent that already exhibits many of these characteristics.

As the result of such evolution, organizations may be faced with a remotely controlled worm that has the ability to infiltrate networks via open channels such as e-mail or Web browsing, can be controlled via outbound connections such as HTTP and FTP, which can pass through many firewalls, and has propagation capabilities that maximize its ability to perform an effective distributed attack.

Source: The Evolution of Malicious Agents by Lenny Zeltser.

Non Conventional Virus Attack

Another paper on the "worst case scenario", but this one takes a slightly different tact with respect to the targets.

Cyber-attack by means of "non-conventional" virus or worms adapted to the telecom world (SDH equipment, management networks, management systems, satellite receivers, etc.) could totally make unusable all the main networks of telecommunication of a country paralyzing the activity in critical sectors like electrical, audio-visual and the banking one at the same time (as long as this attack was planned and executed at the same time on all the networks. We present here a new vision in the existing threads regarding critical telecommunication infrastructures and Homeland Security.

Source: Non Conventional Virus Attack by Raul Alvarez.

Malicious Code in Depth

Worms are just one type of malware that is available on the Internet. This short writeup introduces you to many of the common types of malware out there and the traits they share and also where they differ.

Malicious code refers to a broad category of software threats to your network and systems. Perhaps the most sophisticated types of threats to computer systems are presented by malicious codes that exploit vulnerabilities in computer systems. Any code which modifies or destroys data, steals data, allows unauthorized access Exploits or damage a system, and does something that user did not intend to do, is called malicious code. This paper will briefly introduce you to the various types of malicious code you will encounter, including Viruses, Trojan horses, Logic bombs and Worms.

Source: Malicious Code in Depth by Mohammad Heidari on December 1, 2004.

Computer Worms: Past, Present and Future

This is a short piece that goes over the history of the worm problem and includes many of the mass mailers and worms from the past few years, along with estimated costs of damage.

Internet computer worms have gone from a hypothetical theorem to very real and very dangerous threat to computer networks. They are even capable of affecting the biggest network of our time, the Internet. Starting from humble and beneficial beginnings computer worms are now the plague of the Internet and can cause billions of dollars worth of damages in just a few hours, if not minutes. In this paper I will discuss the history of computer worms, their past, present, and their possible future, but before we start this discussion about computer worms lets first define some computer terminology. It is important that we have these definitions up front not only because we will need them to help explain the rest of this paper, it is also important to discuss this now because the term computer virus is often used interchangeably to refer to computer worms. This may cause confusion with some readers as this paper is focusing on computer worms, not computer viruses. I have chosen not to address viruses because, although viruses take advantage of network services such as the Internet to spread, viruses are currently somewhat less common than worms, and viruses do not seem to have emulated the scale of disruptive behavior, and monetary damage that current computer worms are capable of inflecting on todays computer networks.

Source: Computer Worms: Past, Present and Future by Craig Fosnock on July 27, 2005.

Analysis of the “SQL Slammer” worm and its effects on Indiana University and related institutions

This writeup is interesting, because it shows how a large university detected and dealt with the SQLSlammer worm. There's a lot of information on how a distributed setup played a role in mitigating this problem.

On November 2nd 1988 Robert Morris, then a Cornell University computer science graduate student, released the first Internet worm. Morris’s Worm, as it was known, exploited known flaws in the finger and sendmail services as well as in common webs of trust inherent in the rlogin facility. The worm’s only activity was that of replicating itself to as many hosts as possible. Towards that end, the worm searched local files (such as /etc/hosts) to identify machines to infect as well as scanning likely addresses in the local network. The worm did not damage files or otherwise disrupt operation of the infected machines; however the traffic volume generated by its replication attempts severely disrupted the global Internet, local enterprise networks, and the processing ability of the infected machines themselves. The Morris worm infected roughly 10 percent of Internet computers and cost an estimated 100 million dollars (156 million in 2003 dollars) to clean up.

Like the Morris worm, Slammer’s only disruptive activity was the traffic associated with its replication. SQL Slammer infected less than one in a thousand Internet computers, but its effect was much more dramatic. Slammer targeted random hosts, which is relatively inefficient, however a Slammer infected computer would try as many as 25,000 target addresses a second. The simplicity of the infection method, which required only a single packet to infect a vulnerable computer and, like Morris, exploited a known vulnerability, combined with the speed at which potential computers where probed, allowed Slammer to reach global proportions in less than eight minutes (it doubled in size every 8 seconds). Current estimates put the cost of Slammer at approximately one billion dollars – an order of magnitude more expensive than the Morris worm in constant dollars.

Source: Analysis of the “SQL Slammer” worm and its effects on Indiana University and related institutions, by Gregory Travis, Ed Balas, David Ripley, and Steven Wallace.

Experiences with Worm Propagation Simulations

This is another paper that looks at the utility of modeling computer worm outbreaks. Decent and to the point.

Fast Internet worms are a relatively new threat to Internet infrastructure and hosts. We discuss motivation and possibilities to study the behaviour of such worms and degrees of freedom that worm writers have. To facilitate the study of fast worms we have designed a simulator. We describe the design of this simulator and discuss practical experiences we have made with it and compare observation of past worms with simulated behaviour. One specific feature of the simulator is that the Internet model used can represent network bandwidth and latency constraints.

Source: Experiences with Worm Propagation Simulations, Arno Wagner, Thomas Dübendorfer, Bernhard Plattner, Roman Hiestand

Detecting Worm Propagation Using Traffic Concentration Analysis and Inductive Learning

Another paper on techniques useful for wide area, de novo worm detection.

As a vast number of services have been flooding into the Internet, it is more likely for the Internet resources to be exposed to various hacking activities such as Code Red and SQL Slammer worm. Since various worms quickly spread over the Internet using self-propagation mechanism, it is crucial to detect worm propagation and protect them for secure network infrastructure. In this paper, we propose a mechanism to detect worm propagation using the computation of entropy of network traffic and the compilation of network traffic. In experiments, we tested our framework in simulated network settings and could successfully detect worm propagation.

Source: Detecting Worm Propagation Using Traffic Concentration Analysis and Inductive Learning, Sanguk Noh, Cheolho Lee, Keywon Ryu, Kyunghee Choi, and Gihyun Jung.

Advanced Polymorphic Worms: Evading IDS by Blending in with Normal Traffic

I like this paper a lot, it provides a rigorous treatment of a theoretical future many "worst case scenario" worm paper authors have proposed.

Normal traffic can provide worms with a very good source of information to camouflage themselves. In this paper, we explore the concept of polymorphic worms that mutate based on normal traffic. We assume that a worm has already penetrated a system and is trying to hide its presence and propagation attempts from an IDS.We focus on stealthy worms that cannot be reliably detected by increases in traffic because of their low propagation factor.We first give an example of a simple polymorphic worm. Such worms can evade a signature-based IDS but not necessarily an anomaly-based IDS. We then show that it is feasible for an advanced polymorphic worm to gather a normal traffic profile and use it to evade an anomaly-based IDS.We tested the advanced worm implementation with three anomaly IDS approaches: NETAD, PAYL and Service-specific IDS. None of the three IDS approaches were able to detect the worm reliably. We found that the mutated worm can also evade other detection methods, such as the Abstract Payload Execution.

The goal of this paper is to advance the science of IDS by analyzing techniques polymorphic worms can use to hide themselves. While future work is needed to present a complete solution, our analysis can be used in designing possible defenses. By showing that polymorphic worms are a practical threat, we hope to stimulate further research to improve existing IDS.

Source: Advanced Polymorphic Worms: Evading IDS by Blending in with Normal Traffic, Oleg Kolesnikov, and Wenke Lee.

Scalability, Fidelity and Containment in the Potemkin Virtual Honeyfarm

Another paper on the topic of very large scale honeypot setups to detect malicious activity.

The rapid evolution of large-scale worms, viruses and botnets have made Internet malware a pressing concern. Such infections are at the root of modern scourges including DDoS extortion, on-line identity theft, SPAM, phishing, and piracy. However, the most widely used tools for gathering intelligence on new malware | network honeypots | have forced investigators to choose between monitoring activity at a large scale or capturing behavior with high fidelity. In this paper, we describe an approach to minimize this tension and improve honeypot scalability by up to six orders of magnitude while still closely emulating the execution behavior of individual Internet hosts. We have built a prototype honeyfarm system, called Potemkin, that exploits virtual machines, aggressive memory sharing, and late binding of resources to achieve this goal. While still an immature implementation, Potemkin has emulated over 64,000 Internet honeypots in live test runs, using only a handful of physical servers.

Source: Scalability, Fidelity and Containment in the Potemkin Virtual Honeyfarm, Michael Vrable, Justin Ma, Jay Chen, David Moore, Erik Vandekeift, Alex C. Snoeren, Geoffrey M. Voelker and Stefan Savage, to appear at the 2005 SOSP meeting.

On Deriving Unknown Vulnerabilities from ZeroDay Polymorphic and Metamorphic Worm Exploits

A paper which will be at the upcoiming ACM meeting CCS 2005 introducing a tool called "DACODA", which can be used to analyze attack traffic from worms and develop a robust detection methodology for it.

Vulnerabilities that allow worms to hijack the control flow of each host that they spread to are typically discovered months before the worm outbreak, but are also typically dis- covered by third party researchers. A determined attacker could discover vulnerabilities as easily and create zero-day worms for vulnerabilities unknown to network defenses. It is important for an analysis tool to be able to generalize from a new exploit observed and derive protection for the vulnerability.

Many researchers have observed that certain predicates of the exploit vector must be present for the exploit to work and that therefore these predicates place a limit on the amount of polymorphism and metamorphism available to the attacker. We formalize this idea and subject it to quantitative analysis with a symbolic execution tool called DACODA. Using DACODA we provide an empirical anal- ysis of 14 exploits (seven of them actual worms or attacks from the Internet, caught by Minos with no prior knowledge of the vulnerabilities and no false positives observed over a period of six months) for four operating systems.

Evaluation of our results in the light of these two models leads us to conclude that 1) single contiguous byte string signatures are not effective for content filtering, and token- based byte string signatures composed of smaller substrings are only semantically rich enough to be effective for content filtering if the vulnerability lies in a part of a protocol that is not commonly used, and that 2) practical exploit analysis must account for multiple processes, multithreading, and kernel processing of network data necessitating a focus on primitives instead of vulnerabilities.

Source: On Deriving Unknown Vulnerabilities from ZeroDay Polymorphic and Metamorphic Worm Exploits, Jedidiah R. Crandall, Zhendong Su, S. Felix Wu, and Frederic T. Chong, to appear at CCS05.

Detecting Traffic Anomalies through aggregate analysis of packet header data

On the subject of improved, large scale detection methods and signal processing, this paper presents a way to detect traffic anomalies, which can include worm traffic.

If efficient network analysis tools were available, it could become possible to detect the attacks, anomalies and to appropriately take action to contain the attacks. In this paper, we suggest a technique for traffic anomaly detection based on analyzing correlation of destination IP addresses in outgoing traffic at an egress router. This address correlation data are transformed through discrete wavelet transform for effective detection of anomalies through statistical analysis. Our techniques can be employed for postmortem and real-time analysis of outgoing network traffic at a campus edge. Results from trace-driven evaluation suggest that proposed approach could provide an effective means of detecting anomalies close to the network. We also present data analyzing the correlation of port numbers as a means of detecting anomalies.

Source: Detecting Traffic Anomalies through aggregate analysis of packet header data, by Seong Soo Kim, A. L. Narasimha Reddy, and Marina Vannucci.

Adaptive Detection Of Worms/viruses In Firewalls

An interesting paper, although I'm not entirely sure it will work as well as they hope in the real world. A surprising number of standards are violated in a myriad of ways by various applications and systems, making that kind of protocol analysis difficult to rely on for detection.

In this paper, we seek to answer the question: "How to detect worms/viruses, which are replicated via emails, at the level of a firewall without cooperation with an anti-virus server?" All packets pass through firewalls and only firewalls are able to prevent packets from entering the network. Our motivation is to reduce risk through preventing malicious packets (e.g., worms/viruses) from entering the secure network. We present our firewall model and address how to detect worms/viruses based on protocol sanity, probabilistic estimation of maliciousness, and patterns of packets.

Source: Adaptive Detection Of Worms/viruses In Firewalls, by InSeon Yoo and Ulrich Ultes-Nitsche.

Adaptive Defense Against Various Network Attacks

This paper is much like earlier papers on threshold random walk detection methods used to detect failed connection attempts as well as host and port scans. Since scanning worms will typically scan many hosts and fail to connect frequently, you can look for these failed connection attempts and their sources and identify malicious activity this way. This falls apart under hitlist worms (ie worms which have a target list built in) or application layer worms, but for some classes of worms (including the recent Zotob worm) this should work.

In defending against various network attacks, such as Distributed Denial-of-Service (DDoS) attacks or worm attacks, a defense system needs to deal with various network conditions and dynamically changing attacks. In this paper, we introduce an “adaptive defense” principle based on cost minimization — a defense system adaptively adjusts its configurations according to the network condition and attack severity in order to minimize the combined cost introduced by false positives (misidentify normal traffic as attack) and false negatives (misidentify attack traffic as normal) at any time. In this way, the adaptive defense system generates fewer false alarms in normal situations (or under light attacks) with relaxed defense configurations, while protecting a network or a server more vigorously under severe attacks. Specifically, we present detailed adaptive defense system designs for defending against two major network attacks: SYN flood DDoS attack and Internet worm infection. The adaptive defense is a high-level system design that can be built on top of various non-adaptive detection and filtering algorithms, which makes it applicable for a wide range of security defenses.

Source: Adaptive Defense Against Various Network Attacks, Cliff C. Zou, Nick Duffield, Don Towsley, and Weibo Gong.

The Blaster Worm: Then And Now

This past week myself and several other researchers had our Blaster observations paper published in IEEE Security & Privacy magazine. This is based in large part on an earlier presentation at NANOG 29.

In August of 2003 the Blaster worm struck the Internet, infecting at least 100,000 Microsoft Windows systems and causing millions of dollars in damages. In spite of considerable cleanup efforts, an antiworm aimed at patching systems, and a widely downloaded clean-up tool from Microsoft, the worm is still very much alive. In this article we describe observations of the Blaster worm from its onset in 2003 to its continued persistence a year later.

Source: The Blaster Worm: Then And Now, Michael Bailey, Evan Cooke, Farnam Jahanian, David Watson, and Jose Nazario. This is a galley proof of the paper (the final copy is for subscribers only), so it will contain a few errors and some markup.

In short, the paper has three main points and contributions:

1. Blaster provides an excellent model for a worms life cycle: it's genesis, it's decay, and it's persistence. We have data for all three phases of the worm's life cycle.
2. Like any major worm outbreak, Blaster has not gone away. Over a year later we still see it active, and not from the same hosts. It's population has changed in this time, although the overall size is now constant.
3. neither the Welchia worm nor the Blaster removal tool from Microsoft appeared to make a significant difference in the worm's population.

Net worms could wriggle around warning systems

At last week's Usenix Security 2005, an interesting paper was presented (actually, one of two very related papers). Mapping Internet Sensors With Probe Response Attacks by John Bethencourt, Jason Franklin, and Mary Vernon showed how easy it is for attackers with meager means to reliably identify various early detection networks. The authors focused on the ISC detection network, organized by SANS, but it's a problem that applies to many of these approaches.

Some people are worried about the effect this could have on worm authors. If they discover these networks, can't they simply avoid them in their worm propagation algorithms?

Armed with this information, the creator of a computer worm could create code that bypasses these traps and infects more computers as it spreads. The researchers say the same principle could enable troublemakers to bypass other forms of network defences, including blocks against intruders probing the system and barriers to prevent so-called denial of service attacks.

Several sensor networks provide network administrators with early warning of a possible worm outbreak. These include the SANS Institute's Internet Storm Center based in Maryland, US, the University of Michigan's Internet Motion Sensor and Symantec's DeepSight.

Source: Net worms could wriggle around warning systems, posted on 05 August 2005, via the NewScientist.com news service, written by Will Knight.

Frankly, I'm not very worried about this in the case of worm authors for three main reasons. First, we've seen this sort of thing before. SQLSnake used a list of class A networks with weighting for their relative populations. Still, people found the worm quickly, captured it an danalyzed it because they have live networks instrumented, honeypots in place, and in general watch their networks. Secondly, we've seen a growing prevalence for "island hopping" techniques, for example as used by the Nimda worm. Quoting from the CERT advisory for Nimda:

The selection of potential target IP addresses follows these rough probabilities:

   
• 50% of the time, an address with the same first two octets will be chosen    
• 25% of the time, an address with the same first octet will be chosen    
• 25% of the time, a random address will be chosen

This is not the only worm that has used this technique, many worms these days use this technique. Because the larger dark sensor networks are their own /16s, or even /8s, island hopping propagation tehcniques don't hit those networks as often as they would hit other, nearby allocated networks. It's especially effective at spreading, and yet the worms are caught, analyzed, and alerts are created. Thirdly, plenty of live networks, and dark networks, too, are monitored and the reports are not widely distributed. This defeats the attack mechanism (although other detection techniques are available to the determined attacker) described in the paper, and keeps the world's networks detecting worms.

The benefit of an open project like the ISC, MyNetWatchman and related projects is that they make wide scale statistics available to anyone. The real users of this technique (avoiding these networks) will be individual attackers, not the worm authors, or people interested in poisoning the observations from these   networks. No one relies on them for their total attack detection mechanism, so the threat level involved in this is relatively low.

Analyzing Cooperative Containment of Fast Scanning Worms

This is another interesting modeling paper, originally presented at SRUTI 2005. This paper examines a technique to extend existing control planes (firewalls) to collaborate to contain worm propogations.

Fast scanning worms, that can infect nearly the entire vulnerable population in order of minutes, are among the most serious threats to the Internet today. In this work, we investigate the efficacy of cooperation among Internet firewalls in containing such worms. We first propose a model for firewall-level cooperation and then study the containment in our model of cooperation using analysis and simulation. Our results suggest that, with moderate overhead, cooperation among Internet firewalls can provide 95% containment under 10% deployment while being resilient to 100-1000 malicious firewalls.

Source: Analyzing Cooperative Containment of Fast Scanning Worms, Jayanthkumar Kannan, Lakshminarayanan Subramanian, Ion Stoica, and Randy H. Katz, University of California, Berkeley (published at SRUTI)

On the Effectiveness of Distributed Worm Monitoring

A later version of this paper appeared at USENIX Security 2005. It's one of three that look at the effectiveness of distributed monitoring techniques like the CAIDA network telescope.

Distributed monitoring of unused portions of the IP space holds the promise of providing early and accurate characterization of prevalent security events, especially Internet worms. While this observation has been accepted for some time now, a systematic analysis of the necessary requirements for realizing an effective infrastructure for distributed monitor deployment is still lacking. In this paper, we provide a better understanding of distributed monitoring by characterizing the design space of the problem, and evaluate the practicality of this paradigm. To do so, we present a new evaluation model that relaxes earlier (misguided) assumptions regarding the uniformity of the underlying vulnerable population. Our observational model allows us to evaluate the extent to which monitored size, placement and number of monitors impact on overall detection time. Moreover, we empirically evaluate these criteria on real traces comprising of over 1.5 billion suspicious connection attempts observed by more than 1600 Intrusion Detection systems dispersed across the Internet. Our results are encouraging in that they show that given only partial knowledge of the distribution of vulnerable hosts, the detection capability of a distributed monitoring scheme can be substantially enhanced.

Source: On the Effectiveness of Distributed Worm Monitoring, Technical Report: HINRG-05-01, Moheeb Abu Rajab Fabian Monrose Andreas Terzis, published on February 23, 2005.

Collaborative Internet Worm Containment

Distributed systems for worm detection are nothing new, but are usually interesting. These researchers from USC have a nicely described approach in this IEEE S&P magazine piece.

Large-scale worm outbreaks that lead to distributed denialof-service (DDoS) attacks pose a major threat to Internet infrastructure security. Fast worm containment is crucial for minimizing damage and preventing flooding attacks against network hosts.

Source: Collaborative Internet Worm Containment, M. Cai, K. Hwang, Y.-K. Kwok, S. Song, Y. Chen, published in IEEE Security and Privacy Magazine, May/June 2005. Note that this appears to be a galley proof of the article, so it may contain some errors. The published story doesn't appear to be available for free at this point. IEEE S&P magazine is interesting, however, and is always a good read. This paper is copyright 2005 by the IEEE, all rights reserved.

Impact of network design on worm propagation

I like this paper, because it explores a simple concept, and one that lies at the heart of the problem. To what degree does a network's topology and structure help or hinder worm propagation.

In this paper, we simulate the Code Red II and Nimda worms on different enterprise-scale networks to determine the impact that topology has on worm propagation. A corporate network can be designed to improve security and, as we show, to decrease the propagation rate of worms that use network scanning as a target discovery technique. We also examine the impact that LaBrea-like devices have on propagation rates and compare it to the impact of network topology.

Source: Impact of network design on worm propagation, by Brian Carrier and Sundararaman Jeyaraman and Sarah Sel.

Back-Door'ed by the Slammer

Another SANS GIAC paper. This one studies the SQLSlammer/Sapphire worm and the disaster recovery process that took place when that worm hit.

On Sunday, January 26, 2003, The Company I work for was involved in an incident caused by SQLSlammer. What makes this particularly interesting is that the course of the infection happened from within the company, actually starting at our corporate headquarters. It found its way through a small 56k frame relay connection that had been monitored, but through a configuration mishap, the traffic was allowed through undetected. To make matters worse, a few days before we were hit, we had been in contact with another company that was infected and were taking precautions to avoid being infected ourselves.

The goal of this paper is show how the incident was handled, and demonstrate that even though you may think you're protected, it's imperative to double check your perimeter protection and have good lines of communication with sites that have direct access to your network. I also plan to touch upon the reasons behind not being sufficiently patched and the importance of patch management, along with how the incident was handled, and in parts, mis-handled.

In each of the 6 steps of incident handling: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned, I will describe how the process took place at the time of the incident and also add comments on how the incident could have been handled more efficiently with the knowledge attained from this class.

Source: Back-Door'ed by the Slammer, John Hally

Worms as Attack Vectors: Theory, Threats, and Defenses

Quite a bit of this paper looks very familiar to me ...

Self-replicating, self-propagating, malicious programs (worms) are described in the context of being likely attack mechanisms for a variety of illicit or illegal activities. A brief discussion of what constitutes a typical worm is given, along with a brief history of worms, reasons they may be released, and who might gain from their use. A proposal for future worms is presented. Finally, current and future (proposed) defenses are presented and discussed in light of potential new threats.

Source: Worms as Attack Vectors: Theory, Threats, and Defenses, Matthew Todd.

Security Applications of Peer-to-Peer Networks

An interesting approach describing a P2P architecture to provide both distributed detection and qualification, letting the mesh of systems do the alert aggregation, and then automatic defense instantiation.

Open networks are often insecure and provide an opportunity for viruses and DDOS activities to spread. To make such networks more resilient against these kind of threats, we propose the use of a peer-to-peer architecture whereby each peer is responsible for: (a) detecting whether a virus or worm is uncontrollably propagating through the network resulting in an epidemic; (b) automatically dispatching warnings and information to other peers of a security-focused group; and (c) taking specific precautions for protecting their host by automatically hardening their security measures during the epidemic. This can lead to auto-adaptive secure operating systems that automatically change the trust level of the services they provide. We demonstrate our approach through a prototype application based on the JXTA peer-to-peer infrastructure.

Source: Security Applications of Peer-to-Peer Networks, Vasileios Vlachos, Stephanos Androutsellis-Theotokis, and Diomidis Spinellis. A later version of this paper was published in Computer Networks (Elsevier Science), Volume 45, Issue 2, pp 195-205, June 2004. Also see their JXTA project page for the tool described in the paper, NetBiotic.

Worms: How to stop them?

While a very short paper, it covers an approach that is quite common, namely accurate network worm detection.

These days, networked computers are omnipresent in our day-today life. Their importance in world security in light of recent events related to terrorism is unprecedented. There is no need to belabor the potential havoc that a malicious hand can fix on our lives, upon gaining access to critical computer installations of defense systems or the Internet. Therefore such infrastructure should be protected from being compromised by villains. One of the various ways in which computer systems can be compromised is by deploying a worm.

This research deals with issues such as, when to "cry worm!", proposes models to stop their spread without human intervention, provides simple mathematical models for the proposals, if possible, and provides simulations to test the proposed models. This paper gives a concise overview of the proposed model and shows some of the prelimenary results of the simulations developed.

Source: Worms: How to stop them?, C.G.Senthilkumar. Daisuke Nojiri, Akshay Aggarwal, Jeff Rowe, Karl Levitt.

You can also view C. G. Senthilkumar's master's thesis in PostScript format, which covers worm detection.

ACT: Attachment Chain Tracing Scheme for Email Virus Detection and Control

We often don't post much about mass mailers here, but then again I haven't found too much interesting research in that area. This paper looks quite interesting.

Modern society is highly dependent on the smooth and safe flow of information over communication and computer networks. Computer viruses and worms pose serious threats to the society by disrupting the normal information flow and collecting or destroying information without authorization. Compared to the effectiveness and ease of spreading worms and viruses, currently adopted defense schemes are slow to react and costly to implement.

This paper proposes an automated email virus detection and control scheme using attachment chain tracing (ACT) technique. Based on conventional epidemiology, ACT detects virus propagation by identifying the existence of transmission chains in the network. It uses contact tracing to find epidemiological links between hosts. A soft quarantine scheme is proposed to control virus propagation. No virus signature information is needed for detection and quarantine. We also study the effect of delayed, limited immunization on the spread of viruses. We propose a progressive immunization strategy which uses transmission chain information to guide immunization process. Preliminary simulation experiments show that ACT is a promising scheme.

Source: ACT: Attachment Chain Tracing Scheme for Email Virus Detection and Control, Jintao Xiong.

Detection of New Malicious Code Using N-grams Signatures

This paper takes a somewhat uncommon approach to signature-based detection methods, namely breaking up the detection process. Few people go this route, so it's interesting to study it's efficacy.

Signature-based malicious code detection is the standard technique in all commercial anti-virus software. This method can detect a virus only after the virus has appeared and caused damage. Signature-based detection performs poorly when attempting to identify new viruses. Motivated by the standard signature-based technique for detecting viruses, and a recent successful text classification method, n-grams analysis, we explore the idea of automatically detecting new malicious code. We employ n-grams analysis to automatically generate signatures from malicious and benign software collections. The n-gramsbased signatures are capable of classifying unseen benign and malicious code. The datasets used are large compared to earlier applications of n-grams analysis.

Source: Detection of New Malicious Code Using N-grams Signatures, by Tony Abou-Assaleh, Nick Cercone, Vlado Keselj, and Ray Sweidan.

SMB Shares and Worms - A Parasitic Relationship?

Another SANS practical report they have on their website. These are useful because you get to see how people learned how to collect and analyze malware.

This document will examine the business and technical ramifications of a variant of the Deborm worm. This incident actually happened in a real business environment and more or less had the business repercussions detailed. The fact that this was not a very powerful worm is a lesson to all that the Internet is, as Tom Cruise said in Top Gun, a "target rich environment". No matter how simple the exploit, there are billions of targets out there to choose from. This paper will help the reader understand the worm lifecycle and how to defend against the various strategies they use to move around networks and invade host machines. This worm studied is simple but the lessons learned can be applied to the more complex worms that are appearing today.

Source: SMB Shares and Worms - A Parasitic Relationship? An analysis of the W32/Deborm.worm.q, by Ken Ramsay.

W32 Deloder Worm: The Building of an Army

Deloder is one of the variants of a popular bot these days, very much like Rbot and SDBot.

The recent rash of Internet worms has produced an army of hundreds of thousands of compromised machines that could ultimately be used to launch a massive distributed-denial-of-service attack at any time. These worms allow intruders to remotely control infected computers from one central computer. Officials at the CERT® Coordination Center said the organization is monitoring at least five large networks of compromised machines installed with so-called bots.

The bots connect compromised PCs or servers to Internet Relay Chat servers, which attackers commonly use to execute commands on the remote systems. At least one of these networks is an army of more than 100,000 machines and there are indications that these networks are being used for attacks. Whether the army is used today or held in reserve to be used at some future date for an attack doesn.t really matter. The potential is there for them to cause serious longterm damage.

In addition to the IRC Trojan, computers compromised by the Deloder worm have an additional backdoor which is typically used for network administration. This tool allows the attacker to remotely control the compromised system or spy on every single keystroke. Deloder installs the administration tool with the same password for all systems so that amateur attackers can utilize these compromised systems.

Contributing to the overall problem is the poor security posture of many computer owners with shared resources and broadband Internet access. Deloder and many other recent worms spread by exploiting weak or null passwords used to protect shared network drives and folders.

This paper is a review of the Deloder worm and discusses the vulnerabilities associated with port 445/tcp (Microsoft-ds). The paper has suggestions on how to prevent being a victim of this attack and discusses some techniques for detecting attacks associated with port 445/tcp.

Source: W32 Deloder Worm: The Building of an Army, by Vance Stone.

CARDS: A distributed system for detecting coordinated attacks

Another paper on a distributed data collection and analysis platform. Because worm outbreaks move so quickly and often semi-randomly, a distributed system makes sense: if you can aggregate the information from various disparate sensors, you may be able to detect the worm before it infects all networks.

A major research problem in intrusion detection is the efficient Detection of coordinated attacks over large networks. Issues to be resolved include determining what data should be collected, which portion of the data should be analyzed, where the analysis of the data should take place, and howto correlate multi-source information. This paper proposes the architecture of a Coordinated Attack Response & Detection System (CARDS). CARDS uses a signature-based model for resolving these issues. It consists of signature managers, monitors, and directory services. The system collects data in a flexible, distributed manner, and the detection process is decentralized among various monitors and is event-driven. The paper also discusses related implementation issues.

Source : CARDS: A distributed system for detecting coordinated attacks, Jiahai Yang, Peng Ning, X. Sean Wang, and Sushil Jajodia.

Correlation between NetFlow System and Network Views for Intrusion Detection

This approach, marrying network data from NetFlow, together with system alerts is becoming a reality in the security marketplace. It is the marriage of a traffic monitoring tool and a SEM (or SIM) platform.

We present several ways to correlate security events from two applications that visualize the same underlying data with two distinct views: system and network. Correlation of security events provide Security Engineers a better understanding of what is happening for enhanced security situational awareness. Visualization leverages human cognitive abilities and promotes quick mental connections between events that otherwise may be obscured in the volume of IDS alert messages.

Source: Correlation between NetFlow System and Network Views for Intrusion Detection, Cristina Abad, Yifan Li, Kiran Lakkaraju, Xiaoxin Yin, and William Yurcik.

Connection-history based anomaly detection

One of the things I studied for a few years was intrusion detection research and technologies. While it may seem obvious to some that signature-based methods are effective and popular, that doesn't mean that IDS techniques can't be improved upon. This approach seems especially suited to worm detection.

In the past few years, many vulnerabilities of wide-spread software services, often running on of publicly accessible hosts, have been discovered. These vulnerabilities allow hackers to gain access to those machines, thereby compromising their security. When a vulnerable service is deployed on large numbers of publicly accessible hosts, software tools (called worms) can automate the task of intruding a machine and spreading to new locations. These worms consume a large amount of bandwidth by attempting to find and infect other vulnerable machines and compromise the security and confidentiality of these hosts. Because of the fact that worms are most of the time implemented as directly executable code, they are processed at very high speed. This allows a worm to quickly spread over a network. Usually, it is too late when one manually detects the presence of a worm - in most cases the whole network has already been infected. This makes an automated response mechanism imperative. In this paper, we present an approach to automatically identify worms and perform damage limitation by firewall rule modification.

Source: Connection-history based anomaly detection, Thomas Toth and Christopher Kruegel.

Detecting worms through de-centralized monitoring

Another paper on distributed detection mechanisms.

Worm attack is a large-scale denial-of-service attack on the internet. The attack, because of its global propagation follows some dynamic model. Its behaviour is based on a simple epidemic model with a slow start phase during which infected hosts in- crease exponentially with a positive infection rate. Based on this model Towsley et. al. put forth the idea of "detecting the trend, not the rate" of monitored worm scan traffic and employed a Kalman filter to detect worm propagation. They also pro- posed a centralized worm monitoring architecture where monitors distributed over the internet gathered data on worm activities and communicated it to a central Malware Warning Centre. This report suggests a two-level hierarchy for the monitoring system. The first-tier monitors collect the scan data at the ISP level. And second-tier mon- itors share the estimates to detect the trend across ISPs i.e. globally. The first-tier monitors estimate the trend by employing LMS algorithm in a distributed manner. And fast-distributed-linear-averaging techniques are employed to make ISPs come to consensus about the global trend.

Source: Detecting worms through de-centralized monitoring, Raman Arora.

Modular worms

A paper that explores some of the same topics a paper we wrote in 2001 did, namely a plugable modular system for malware. While it hasn't yet been fully realized to quite the same degree we envisioned it, the accessability of worm source code, such as the Rbot code, together with the plethora of backdoors and exploit techniques makes this almost a reality at this point.

CodeRed and Nimda internet worms clearly demonstrated today's internet vulnerability. Technologies currently used by worm writers allow serious paradigm shift: modular, reusable and upgradeable worm design. Wide acception of these principles will dramatically increase malware penetration ability and staying power. Clear understanding of these possibilities will help to make adequate solutions on software design.

Source: Modular worms, Viktor S. Grichenko.

A physiological decomposition of virus and worm programs

A masters thesis that attempts to decompose worms into their functional units and understand them from that perspective. Tougher than it looks, and I worry the author didn't cite enough material for a complete understanding of the research area.

Computer viruses and worms may be written in an infinite number of ways. Yet, a dissection of several viruses and worms shows that though differing in code, they have functionally similar components, where a component is one or more noncontiguous statements responsible for a specific behavior or capability of a these programs. Drawing an analogy to organisms, a component may be considered an organ. The thesis identifies a collection of organs that are found in computer viruses and worms. The need for each organ can be reasoned directly from the capabilities required of any of these types of programs. The collection of organs identified then describes the anatomy of a computer virus or worm. Having identified the organs of these programs, the thesis raises the question: Can one automatically detect the presence or absence of these organs in a program? It is hypothesized that techniques that detect a worm or virus by analyzing the code for the presence or absence of specific organs are likely to catch a large variation, mutants or similar species, without explicit training. Such techniques may help in developing virus and worm scanners that are not always lagging the worm attacks.

Source: A physiological decomposition of virus and worm programs, Prabhat Kumar Singh.

A Hybrid Honeypot Architecture for Scalable Network Monitoring

One of those classics. Recall that Bailey, Cooke and Watson are behind the IMS project, and Provos is the main author of Honeyd.

To provide scalable, early warning and analysis of new Internet threats like worms or automated attacks, we propose a globally distributed, hybrid monitoring architecture that can capture and analyze new vulnerabilities and exploits as they occur. To achieve this, our architectures increases the exposure of high-interaction honeypots to these threats by employing low-interaction honeypots as frontend content filters. Host-based techniques capture relevant details such as packet payload of attacks while network monitoring provides wide coverage for quick detection and assessment. To reduce the load of the backends, we filter prevalent content at the network frontends and use a novel handoff mechanism to enable interactions between network and host components. We use measurements from live networks over five months to demonstrate the effectiveness of content prevalence as a filtering mechanism. Combining these observations with laboratory measurements, we demonstrate that our hybrid architecture is effective in preserving the detail of a specific threat while still achieving performance and scalability. We illustrate the benefits of this framework by showing how it enables earlier, higher-confidence detection, more detailed forensics, and robust signatures for mitigation of threats.

Source: A Hybrid Honeypot Architecture for Scalable Network Monitoring, Michael Bailey, Evan Cooke, David Watson, Farnam Jahanian, and Niels Provos.

On the functional validity of the worm-killing worm

Another paper that looks at the counterworm principle, some modeling, and attempts to come up with a better way to utilize this approach and not cause any of the obvious harmful side effects. I don't buy it, and I'm still against the idea of a "good worm".

The notion of worm-killing worm has been in the folklore for some time . However the obvious fear of the killer worm itself being compromised, or of any self-propagating code set loose (possibly over administrative boundaries), has barred serious exploration on the practical aspects of the idea. In this paper, we suspend such concerns momentarily, and investigate its functional validity. This effort is motivated by recent fast worm epidemics exemplified by that of SQL Slammer, which was overwhelmingly faster than traditional human-intervened response. Specifically, this paper evaluates the killer worm in terms of the prevention effect and the incurred traffic cost. Above and beyond, we consider supplementary techniques that could boost the performance and mitigate the harmful side -effects of the worm-killing worm.

Source: On the functional validity of the worm-killing worm, Hyogon Kim and Inhye Kang.

Visualisation for Intrusion Detection: Hooking the Worm

I like this paper a lot because it attempts to leverage the intelligence that the operator and analyst have and quickly distill the information to them using visualization techniques. Such approachs have been of interest to me for a number of years, although I have yet to find many that I like. In the absence of robust algorithms that can mimic the human deductive and inductive reasoning process, this approach seems to make the most sense to me.

Even though intrusion detection systems have been studied for a number of years several problems remain; chiefly low detection rates and high false alarm rates.

Instead of building automated alarms that trigger when a computer security violation takes place, we propose to visualise the state of the computer system such that the operator himself can determine whether a violation has taken place. In effect replacing the .burglar alarm. with a .security camera..

In order to illustrate the use of visualisation for intrusion detection purposes, we applied a trellis plot of parallel coordinate visualisations to the log of a small personal web server. The intent was to find patterns of malicious activity from so called worms, and to be able to distinguish between them and benign traffic. Several such patterns were found, including one that was unknown at the time to the security community at large.

Source: Visualisation for Intrusion Detection: Hooking the Worm, by Stefan Axelsson.

Virtual Playgrounds For Worm Behavior Investigation

This paper brings up a bunch of lessons I learned when I built a small network for studying worm propagation techniques as well as the software tools to track them when I wrote my book. I found that it's not as easy as it may sound at first, and a number of real, hard considerations must be taken into account. This paper seems to study a lot of those issues in a very skillful way.

To detect and defend against Internet worms, researchers have long hoped to have a safe convenient environment to unleash and run real-world worms for close observation of their infection, damage, and propagation. However,major challenges exist in realizing such .wormplaygrounds., including the playgrounds. fidelity, confinement, scalability, as well as convenience in worm experiments. In this paper, we present a virtualizationbased platform to create virtual worm playgrounds, called vGrounds, on top of a physical infrastructure. A vGround is an all-software virtual environment dynamically created for a worm attack. It has realistic end-hosts and network entities, all realized as virtual machines (VMs) and confined in a virtual network (VN). The salient features of vGround include: (1) high fidelity supporting real worm codes exploiting real vulnerable services, (2) strict confinement making the real Internet totally invisible and unreachable from inside a vGround, (3) high resource efficiency achieving sufficiently large scale of worm experiments, and (4) flexible and efficient worm experiment control enabling fast (tens of seconds) and automatic generation, re-installation, and final teardown of vGrounds. Our experiments with real-world worms (including multi-vector worms and polymorphic worms) have successfully exhibited their probing and propagation patterns, exploitation steps, and malicious payloads, demonstrating the value of vGrounds for worm detection and defense research.

Source: CERIAS Tech Report 2005-24: Virtual Playgrounds For Worm Behavior Investigation, Xuxian Jiang, Dongyan Xu, Helen J. Wang, Eugene H. Spafford.

Polygraph: Automatically Generating Signatures for Polymorphic Worms

I've posted about polymorphic worms before, and this paper seeks to address some of the problems facing intrusion detection systems in the face of continually changing payloads and specifically in light of worm attacks, where the pace of the attacks is dramatic.

It is widely believed that content-signature-based intrusion detection systems (IDSes) are easily evaded by polymorphic worms, which vary their payload on every infection attempt. In this paper, we present Polygraph, a signature generation system that successfully produces signatures that match polymorphic worms. Polygraph generates signatures that consist of multiple disjoint content substrings. In doing so, Polygraph leverages our insight that for a real-world exploit to function properly, multiple invariant substrings must often be present in all variants of a payload; these substrings typically correspond to protocol framing, return addresses, and in some cases, poorly obfuscated code. We contribute a definition of the polymorphic signature generation problem; propose classes of signature suited for matching polymorphic worm payloads; and present algorithms for automatic generation of signatures in these classes. Our evaluation of these algorithms on a range of polymorphic worms demonstrates that Polygraph produces signatures for polymorphic worms that exhibit low false negatives and false positives.

Source: Polygraph: Automatically Generating Signatures for Polymorphic Worms, James Newsome, Brad Karp, and Dawn Song.

Anatomy of the web application worm

Another paper which looks at the hypothetical future of more intelligent worms, ones which actively try and find holes and develop working attacks.

Today's internet worm as mentioned above relies on particular system daemons to be exploited with either known, or unpublished exploits. Usually a worm will attack a service such as ftp, your mail daemon, or your webserver (see Code Red and Nimda). Of course one way of stopping a worm from spreading is patching your application so infection is not possible. Once your application is patched from the hole in question, you are considered safe. What if a worm had been created to not only infect applications, but find new holes in them as well. This would mean that the worm would not depend on a machine running a specific application, and therefore the worm would be harder to stop. Some people decide not to check for product updates for months for some or all of their applications in use. This can lead to spreading of the worm for longer periods of time. If a machine was infected by custom applications written by either staff at the company, or their consultants ,then it may take some time for a patch to be written and the spread of the worm to stop. On top of this what if the same machine had two applications infected at the same time?

Source: Anatomy of the web application worm, by admin(at)cgisecurity.com.

PISA: Automatic Extraction of Traffic Signatures

Automatic worm signature generation in the face of a worm outbreak is a research goal of several groups. What they seek to do is to detect the presence of a threat and characterize it automatically so that additional systems, such as an IDS, can measure and disrupt the worm's progress. This paper is another one of those which shows a direct method to characterize attack traffic, including worm and DDoS traffic. The authors used real captured data to evaluate their system and report on the efficacy of the detection of the Blaster worm.

Analysis of security attacks shows that an attack leaves its imprint or signature in the attack packets. Traffic from Distributed Denial of Service attacks and rapid worm spreads has the potential to yield signatures. While all signatures may not be indicative of attacks, it is useful to extract non-transient signatures that are carried by a sufficient number of flows/packets/bytes. The number of packets/bytes in the flows carrying the signature may be used for rate-limiting the flows, providing for timely and automated response to both known and unknown attacks. This paper proposes an efficient algorithm, PISA, which clusters flows based on similarity in packet information and extracts signatures from highbandwidth clusters. Extensive experiments on two weeks of real attack data of 100 million packets yield about 1744 signatures. Additionally, PISA extracted the signature for the Blaster worm connection attempts in a mix of traffic from a trans- Pacific backbone link.

Source: PISA: Automatic Extraction of Traffic Signatures, Parminder Chhabra, Ajita John, and Huzur Saran, Networking 2005, © 2005 Spinger-Verlag. Found via the author and the Avaya Research website.

Models of Internet Worm Defense

David Nicol has an interesting presentation slide deck available, Models of Internet Worm Defense [PDF]. Sadly, there's no abstract associated with it, but Nicol's slide deck covers a number of mechanisms peple have looked at for worm defense, including quarantine, counter worms, and patching. He backs up his analysis and conclusions with sound mathematical modeling and lots of equations, as well as pretty graphs. You'll want to study the graphs for a while to see the true story there. If you print them out, make sure you get them in color as some of the information is stored in the color spectrum used.

A Reputation-based System for the Quarantine of Widespread Malicious Behavior

One of the more unique approach I've seen in a while, one that attempts to mix the idea of reputation networks (which themselves can piggyback on social networks or simply mirror them) with quarantine ideas. I don't know how feasible or even worthwhile this approach can be, but it is one of the more creative solutions I've seen proposed for the management of quarantine risks.

People use the recommendations of friends and neighbors to make important decisions daily. For instance, when moving to a new neighborhood people may ask co-workers to recommend good doctors in the area. This idea of reputation, along with peer recommendations, is also heavily used in a number of eCommerce and eBusiness systems, such as eBay and Amazon.com. In order to protect the Internet infrastructure that has become so critical in our everyday lives, we propose a system which uses these ideas of reputation and recommendation to effectively quarantine widespread malicious behavior on the Internet, thereby limiting the bandwidth it consumes and preventing ancillary denial of service at core Internet nodes. In addition to protecting the core Internet infrastructure from this type of ancillary denial of service attack, we have also shown that our system can prevent the spread of self-propagating worms, spam, and typical, human-propagated computer viruses – essentially any widespread malicious activity.

Source: A Reputation-based System for the Quarantine of Widespread Malicious Behavior, by Scott E. Coull and Boleslaw K. Szymanski.

Let free(dom) Ring!

While the Slapper worm dates from 2002, it was an interesting display of a fingerprinting worm. It also showed how remarkably easy it can be to build an effective worm, and one with a P2P control network built in.

On 30 July, 2002 a security advisory from A.L. Digital Ltd and The Bunker disclosed four critical vulnerabilities in the OpenSSL package. OpenSSL is a free implementation of the Secure Socket Layer protocol used to secure network communications and it provides cryptographic primitives to many popular software packages, including the Apache web server. Less than two months later, the Linux/Slapper worm successfully exploited one of the buffer overflows described in the advisory and, in a matter of days, spread to thousands of machines around the world.

Linux/Slapper is one of the most significant outbreaks on Linux systems to date. Although the worm has the potential to infect many more machines, it skips private network classes such as 192.168.0.0/16 intentionally and thus it will not spread on local networks. Slapper shows many similarities with the FreeBSD/Scalper worm, hence the name.

Source: Let free(dom) Ring!, by Frédéric Perriot and Péter Ször.

WormShield

A very short (1 page) description of a project that marries some interesting technologies. The authors' main goals appear to be to both use the dstributed nature of a grid computer system to provide detection and control techniques, as well as providing a self-defending nature to the grid system itself, thereby protecting large scale grid computers on an open Internet.

Problem Large-scale worm outbreak is one of the major security threats to today’s Internet. Network worms exploit the vulnerabilities of widely deployed homogenous software to self-propagate quickly. Moore et al show that the react time of worm containment is only a few minutes and the signature-based filtering is more efficient than source-address filtering. Recent work by Earlybird and Autograph suggests that it is promising to automatically detect worm signatures by analyzing their content prevalence and address dispersion. However, most scanning worms will be dispersed on the whole Internet when they start to spread. In the early stage of worm spreading, it is difficult to accumulate enough payloads to generate precise signatures in individual edge networks.

Approach To solve this problem, we propose to design and implement a distributed worm signature detection and dissemination system (WormShield) that collaboratively analyzes worm activities in multiple administrative domains. In WormShield, all monitors deployed in edge networks self-organize into a distributed hash table (DHT) overlay network. Instead of only sharing port-scanning information like Autograph, WormShield monitors collaboratively analyze the global prevalence of payload contents and their address dispersion using distributed aggregation trees (DAT) built on top of the Chord overlay.

Source: WormShield: Collaborative Worm Signature Detection Using Distributed Aggregation Trees, by Min Cai, Runfang Zhou, Kai Hwang, Christos Papadopoulos, and Shanshan Song.

You can see a larger description here, and some examples of the architecture in action.

The USC GridSec project develops distributed security infrastructure  and self-defense capabilities to secure wide-area networked resource sites  participating in a Grid application.  We report new developments in trust  modeling, security-binding methodology, and defense architecture against  intrusions, worms, and flooding attacks.  We propose a novel architectural  design of Grid security infrastructure, security binding for enhanced Grid  efficiency, distributed collaborative IDS and alert correlation, DHT-based  overlay networks for worm containment, and pushback of DDoS attacks.   Specifically, we present a new pushback scheme for tracking attack-transit  routers and for cutting malicious flows carrying DDoS attacks. We discuss  challenging research issues to achieve secure Grid computing effectively in an  open Internet environment.   

Source: GridSec: Trusted Grid Computing with   Security Binding and Self-defense Against   Network Worms and DDoS Attacks, by  Kai Hwang, Yu-Kwong Kwok, Shanshan Song, Min Cai Yu Chen,  Ying Chen, Runfang Zhou, and Xiaosong Lou.

UPDATE: Fixed the link to the first paper, thank you Jim.

SQLExp SQL Server Worm Analysis

While the SQLSlammer worm is history (January, 2003), this analysis is still interesting. It shows how various forms of data analysis can pay together.

On January 25, 2003, the DeepSight Threat Management System registered a sudden and extremely large increase in UDP traffic targeted at port 1434; this port is commonly associated with the Microsoft SQL Server Monitor. This significant rise in attack activity was later confirmed to be the result of a memory-resident worm named W32.SQLExp.Worm. W32.SQLExp.Worm exploits a stack overflow vulnerability in the Microsoft SQL Server Monitor in order to distribute itself. As a result of SQLExp's propagation process and generation of copious amounts of network traffic, degradation of network performance

Source: DeepSight. Threat Management System, Threat Analysis: SQLExp SQL Server Worm Analysis, Jensenn Roculan, Sean Hittel, Daniel Hanson, Jason V. Miller, Bartek Kostanecki, Jesse Gough, Mario van Velzen, Oliver Friedrichs, January 28, 2003.

Simulation and Analysis on the Resiliency and Efficiency of Malnets

A paper from PADS 2005 that explores the future of worm-delivered malware like bots and other crimeware.

Future network intruders will probably use an organized army of malicious nodes (here called "malnodes", or collectively a "malnet") to deliver many different attacks, rather than recruiting a disorganized set of compromised nodes per attack. However, partly due to the lack of understanding of the resiliency and efficiency a malnet can have, countering malnets has been ineffective.

This paper begins to address this defficiency. Through calculation and simulation for three representative malnets|random, small-world, and Gnutella-like|we show that extremely resilient malnets can be formed to deliver attack code quickly. In particular, we show that disconnecting malnets is possible, but extremely naive approaches such as randomly disinfecting malnodes will not suffice, and effective defenses must either happen very quickly during a second-wave attack, or take effect prior to it.

Source: Simulation and Analysis on the Resiliency and Efficiency of Malnets, Jun Li, Toby Ehrenkranz, Geoff Kuenning, Peter Reiher. To appear at PADS 2005.

Fast Worm Propagation In IPv6 Networks

Another post which looks at the possible effects of an IPv6 Internet on worm propogation. Fast Worm Propagation In IPv6 Networks, by Jing Yang. This time it's a PowerPoint presentation, full of analysis and lots of bullet points. This slide deck is quite readable, by the way, even without any aditional notes. The author goes from a classic, "it would take eons to scan the entire IPv6 address space" to a position which shows, quite handily, how a worm could successfully operate in an IPv6 Internet and still be efficient (although maybe not as efficient as an IPv4 worm). A worthwhile read as we look ahead to IPv6 deployments seeing wider use.

The Effect of DNS Delays on Worm Propagation in an IPv6 Internet

Finally, a paper that look at the common idea that IPv6 networks will be safe from worm attacks.I think this paper says it better than I have been able to for the past couple of years.

It is a commonly held belief that IPv6 provides greater security against random-scanning worms by virtue of a very sparse address space. We show that an intelligent worm can exploit the directory and naming services necessary for the functioning of any network, and we model the behavior of such a worm in this paper. We explore via analysis and simulation the spread of such worms in an IPv6 Internet. Our results indicate that such a worm can exhibit propagation speeds comparable to an IPv4 random-scanning worm. We develop a detailed analytical model that reveals the relationship between network parameters and the spreading rate of the worm in an IPv6 world. We also develop a simulator based on our analytical model. Simulation results based on parameters chosen from real measurements and the current Internet indicate that an intelligent worm can spread surprising fast in an IPv6 world by using simple strategies. The performance of the worm depends heavily on these strategies, which in turn depend on how secure the directory and naming services of a network are. As a result, additional work is needed in developing detection and defense mechanisms against future worms, and our work identifies directory and naming services as the natural place to do it.

Source: The Effect of DNS Delays on Worm Propagation in an IPv6 Internet, Abhinav Kamra, Hanhua Feng, Vishal Misra and Angelos D. Keromytis.

Detection of Mass Mailing Worm-infected IP address by Analysis of Syslog for DNS server

Another paper which explores the DNS-based detection mechanism for mass-mailer worms, this time a full blown paper.

The syslog messages of the topdomain-secondary DNS server in Kumamoto University were statistically investigated when infection of mass mailing worm (MMW) like W32/Sobig, W32/Mydoom, and W32/Netsky were increased worldwidely. The interesting results are: (1) The MMW-infected PC terminal sends packets including only both A and MX records to the DNS server when going on MMW-infection. (2) The hijacked/UNIX-like PC terminal transmits packets including A, MX, and PTR records to the DNS server in a spam relay. Therefore, we can detect MMW-infected PC terminals by only monitoring the DNS query traffic from the DNS clients like PC terminals.

Source: Detection of Mass Mailing Worm-infected IP address by Analysis of Syslog for DNS server, Ryuichi Matsuba, Yasuo Musashi, and Kenichi Sugitani.

Another paper from the same group that is worth looking at is Detection of Mass Mailing Worm-infected PC terminals by Observing DNS Query Access, which continues the analysis and methodology.

Web Application Worms: Myth or Reality?

A paper which explores a once hypothetical scenario, application worms. These aren't entrely the stuff of fiction, as Santy, a worm that used Google to detect vulnerable sites, and Anti-Santy, another worm which used Google to detect its targets, have both been seen in the wild. Were they faster than Code Red or Slammer? Not really, although that's possibly not the fault of the method. They were, however, easy to detect and stop.

This paper discusses the possibility of automated, self-propagating attacks on custom Web application code. It will show that such attacks are not only feasible but that their theoretical success rate is far greater than worms targeting commercial infrastructure (e.g., Slammer, Code Red, Blaster, Nachi, etc.).

It is the intent of this paper to raise awareness of the threat posed by automated attacks on vulnerabilities that exist in every organization's Web infrastructure. Threats of this type that cannot be avoided by counting on current IPS technologies and the law of large numbers.

Source: Web Application Worms: Myth or Reality?, by Amichai Shulman.

Traffic Analysis on a Mass Mailing Worm and DNS/SMTP

From researchers in Japan and found on the website of Yasuo Musashi, Traffic Analysis on a Mass Mailing Worm and DNS/SMTP [PDF], a presentation by Yasuo Musashi, Kenichi Sugitani, and Ryuichi Matsuba. Now, what they've done is interesting and so simple it's beautiful. It turns out that aside from a large number of mails that all look similar and are sent bypassing the local SMTP relay, mass mailer worm infected hosts also generate a large number of DNS requests for MX records of their targets. They don't do this under normal operations (where they relay mail through a local SMTP server that they get an A record for), so you can easily measure this and detect a mass mailer infected system. Using the technique and principles described in this presentation (prior to finding it, I might add), I built a small prototype in Python using libpcap and was able to reliably detect mass mailer infected hosts within a few minutes. A simple solution that doesn't require much heavy analysis. Unfortunately, I am unable to share the code with the general public at this time.

Chiba Witty Blues and Blastoff!

A short but intetresting pair of papers from Peter Szor and company on Witty and Blaster:

W32/Witty is a UDP-based worm employing a vulnerability in ISS security products, such as the BlackICE firewall, to spread. More specifically, Witty uses a stack buffer overflow in the code that parses ICQ v5 packets.

Witty is very similar to last year’s W32/Slammer (see VB, March 2003, p.6) in a number of ways: it is short (only 647 bytes for the attack buffer, excluding the variable UDP payload padding), its sending rate is limited only by available bandwidth, and it selects random target IP addresses. Unlike Slammer, however, Witty features a very destructive payload: it overwrites random portions of the hard drives of machines it infects.

Source: CHIBA WITTY BLUES, Peter Ferrie, Frédéric Perriot, Péter Ször, Virus Bulletin, May, 2004.

On 11 August 2003 – the same day it was completed – a 6176-byte-long UPX-compressed bug started to invade the world using a recent vulnerability described in Microsoft’s MS03-26 security bulletin. Even Windows Server 2003 was affected by this vulnerability. Patches were made available by Microsoft, but on this occasion there was only a short delay between the announcement of the vulnerability and the appearance of the worm that exploited it.

Users of Windows XP had a chance to get the patch applied automatically via Windows Automatic Updates. However, the same cannot be said for the Windows 2000 platforms, where users would need to pay closer attention to the update procedures

Source: Blast Off!, Peter Ferrie, Frédéric Perriot, Péter Ször, September, 2003.

Internet Worms As Internet-wide Threat

A review article that does a decent job of introducing the worm research landscape. While certainly not complete, it's a good read.

A computer worm is a program that propagates itself over a network, reproducing itself as it goes. Because of the recursive structure of this propagation, the spread rate of worms is very fast and poses a big threat on the Internet infrastructure as a whole. Modern worms are capable of gaining control over a substantial portion of the Internet hosts within several minutes. No human mediated response is possible to stop an attack that is so rapid. Possible devastating effects on the Internet operation are hard to underestimate given that even traffic generated for the victim probes and worm propagation is so huge that it can be considered as a DDoS attack on the whole Internet and already used to bring down the Internet infrastructure of the whole countries. In this paper we present a survey of the existing worms and proposed methods of their containment.

Source: Internet Worms As Internet-wide Threat, Nikolai Joukov and Tzi-cker Chiueh.

On Computer Viral Infection and the Effect of Immunization

Another paper by some of the more interesting authors in the field, Wang and Knight. An interesting analysis worth a read.

Viruses remain a significant threat to modern networked computer systems. Despite the best efforts of those who develop anti-virus systems, new viruses and new types of virus that are not dealt with by existing protection schemes appear regularly. In addition, the rate at which a virus can spread has risen dramatically with the increase in connectivity. Defenses against infections by known viruses rely at present on immunization yet, for a variety of reasons, immunization is often only effective on a subset of the nodes in a network and many nodes remain unprotected. Little is known about either the way in which a viral infection proceeds in general or the way that immunization affects the infection process. In this paper we present the results of a simulation study of the way in which virus infections propagate through certain types of network and of the effect that partial immunization has on the infection. The key result is that relatively low levels of immunization can slow an infection significantly.

Source: On Computer Viral Infection and the Effect of Immunization,  Chenxi Wang, John C. Knight, Matthew C. Elder.

A predator prey approach to the network structure of cyberspace

Another "big picture" type of paper, and one that seeks to look at the problems caused by worms and related network malware (spam, DDoS, etc) in a new view.

In light of the rise of malicious attacks on the Internet and the various networks and applications attached to it, new approaches towards modeling predatory activity in networks is called for. Past research has simulated networks assuming that all nodes are homogenously susceptible to attack or infection. Often times in real world networks only subsets of nodes are susceptible attack or infection in a heterogeneous population of nodes. One approach to examining a heterogeneous network susceptible to attack is modeling cyberspace as a predator prey landscape. If each type of vulnerable device is considered a heterogeneous species what level of species diversification is needed to keep a malicious attack from a causing a catastrophic failure to the entire network. This paper explores the predator prey analogy for the Internet and presents findings on how different levels of species diversification effects network resilience. The paper will also discuss the connection between diversification, competition, anti-trust, and national security.

Source: A predator prey approach to the network structure of cyberspace, Sean P. Gorman,  Rajendra G. Kulkarni, Laurie A. Schintler, and Roger R. Stough.

Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks

An increaisng number of people are seeing the intersection of malware and automated delivery mechanisms rise in frequency and impact. I've long since looked at worms as an excellent malware distribution platform. The result is often called a 'botnet'. In this paper, three German researchers describe how they cna detect the presence of a botnet and infer its structure using very direct techniques.

Denial-of-Service (DoS) attacks pose a significant threat to the Internet today especially if they are distributed, i.e., launched simultaneously at a large number of systems. Reactive techniques that try to detect such an attack and throttle down malicious traffic prevail today but usually require an additional infrastructure to be really effective. In this paper we show that preventive mechanisms can be as effective with much less effort: We present an approach to (distributed) DoS attack prevention that is based on the observation that coordinated automated activity by many hosts needs a mechanism to remotely control them. To prevent such attacks, it is therefore possible to identify, infiltrate and analyze this remote control mechanism and to stop it in an automated fashion. We show that this method can be realized in the Internet by describing how we infiltrated and tracked IRC-based botnets which are the main DoS technology used by attackers today.

Source: Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks, Felix C. Freiling and Thorsten Holz and Georg Wicherski.

Anti-Malware Tools: Intrusion Detection Systems

Martin Overton, from IBM in the UK, is back with another interesting malware paper. He's got an outline of how to use Snort to detect malware in transit on the wire.

When most people think of tools to combat malware, very few will give a passing thought to Intrusion Detection Systems, why?

Common reasons include:

• They don’t realise that IDS systems can be used against malware (viruses, Trojans, worms, etc.)
• They are too difficult to setup, maintain and use.
• That they are too prone to false alarms.

This paper will investigate the use of IDS systems, specifically to counter/block/detect malware. What’s more, this paper will focus on SNORT (which is a free IDS system available for both UNIX and Windows).

This paper will include instructions and guidance on the setup of such a system, numerous examples of suitable rules to detect and block malware and useful tools that can make the sifting of logs easier and more palatable as well as configuration and other tools and utilities that may be useful in managing and maintaining SNORT.

The use of an IDS system can be extremely useful in cases of fast burning or very complex malware outbreaks as a stop-gap until the anti-virus vendors manage to get reliable updates out to their customers.

An IDS is also useful in identifying infected systems in your organization that need remedial action before the ‘trickle’ of infections become a ‘torrent’ and you are left fighting to keep your head above the rising waters.

This paper is based on the recent two-part article written for Virus Bulletin [October and November 2004] and parts of that article have been used with their permission.

Anti-Malware Tools: Intrusion Detection Systems, Martin Overton, IBM, UK. Presented at the 2005 EICAR conference.

Outwitting the Witty Worm

An interesting analysis of the Witty work (March, 2004) data from the CAIDA team and another author. It shows the power of analyzing a raw data set with information about the worm itself. Have a look at a recent paper that was here on Wormblog, too, Worm Hotspots: Explaining Non-Uniformity in Worm Targeting Behavior. What at first appears random isn't, and just when you think you've done a thorough analysis you realize there's more to do, and more that can be done.

Network ``telescopes'' that record packets sent to unused blocks of Internet address space have emerged as an important tool for observing Internet-scale events such as the spread of worms and the backscatter from flooding attacks that use spoofed source addresses. Current telescope analyses produce detailed tabulations of packet rates, victim population, and evolution over time. While such cataloging is a crucial first step in studying the telescope observations, incorporating an understanding of the underlying processes generating the observations allows us to construct detailed inferences about the broader "universe" in which the Internet-scale activity occurs, greatly enriching and deepening the analysis in the process.

In this work we apply such an analysis to the propagation of the Witty worm, a malicious and well-engineered worm that when released in March 2004 infected more than 12,000 hosts worldwide in 75 minutes. We show that by carefully exploiting the structure of the worm, especially its pseudo-random number generation, from limited and imperfect telescope data we can with high fidelity: extract the individual rate at which each infectee injected packets into the network priorto loss; correct distortions in the telescope data due to the worm's volume overwhelming the monitor; reveal the worm's inability to fully reach all of its potential victims; determine the number of disks attached to each infected machine; compute when each infectee was last booted, to sub-second accuracy; explore the "who infected whom" infection tree; uncover that the worm specifically targeted hosts at a US military base; and pinpoint Patient Zero, the initial point of infection, i.e., the IP address of the system the attacker used to unleash Witty.

Source: Outwitting the Witty Worm: Exploiting Underlying Structure for Detailed Reconstruction of an Internet Scale Event, by Abhishek Kumar, Vern Paxson, Nicholas Weaver.

Superworms and Cryptovirology: a Deadly Combination

This paper seems more like an excuse to mix a few topics together to try and create a nightmare scenario than actual research.

Understanding the possible extent of the future attacks is the key to successfully protecting against them. Designers of protection mechanisms need to keep in mind the potential ferocity and sophistication of viruses that are just around the corner. That is why we think that the potential destructive capabilities of fast spreading worms like the Warhol worm, Flash worm and Curious Yellow need to be explored to the maximum extent possible. While re-visiting some techniques of viruses from the past, we can come across some that utilize cryptographic tools in their malicious activity. That alarming property, combined with the speed of the so-called “superworms”, is explored in the present work. Suggestions for countermeasures and future work are given.

Source: Superworms and Cryptovirology: a Deadly Combination, Ivan Balepin.

Although this may not be as unfathomable as I originally thought. According to this AP report, ransomware has been found in the wild:

Security researchers at San Diego-based Websense Inc. uncovered the unusual extortion plot when a corporate customer they would not identify fell victim to the infection, which encrypted files that included documents, photographs and spreadsheets.

A ransom note left behind included an e-mail address, and the attacker using the address later demanded $200 for the digital keys to unlock the files.

Source: Internet infection holds computer files 'hostage', by Ted Bridis (Associated Press), Tuesday, May 24, 2005.

UPDATE: The original link to the paper was broken in the time between the composition of this post and it's appearance. The link has been updated.

Traffic Characterization of the Web Server Attacks of Worm Viruses

I like this paper because it looks at the worm problem from another approach, namely making software more fault tolerant in the face of a massive attack. Recall the number of non-infected web servers that fell off the network during Code Red and Nimda. This paper seems like a natural follow on to that observation. I'd be curious to see someone code a plugin for a web server that attempted to implement some of the findings from this paper.

With the explosive popularity of the Internet, the number of accessible web servers has proliferated as well. Subsequently, malicious attacks on these servers via viruses have become more prevalent. Due to the self-propagation and self-duplication nature of these viruses, such attacks can congest the network quickly, aggravating the already limited bandwidth available and curtail service provided by the server, eventually leading to denial of all services. The IIS, in particular, has been gravely affected by such Denial of Service (DoS) attacks. Hence, various methods to prevent such attacks from affecting the network and server have been researched and proposed. In this paper, we analyze the characteristics of worm virus attack traffics, by extracting and analyzing virus attack logs. With the use of various statistical methods, we show that worm attack patterns show self-similarity with Hurst parameter H. Our purpose is to use this characteristic in annulling the negative effects of worm attacks.

Source: Traffic Characterization of the Web Server Attacks of Worm Viruses, Kihun Chong A, Ha Yoon Song A, Sam H. Noh A.

Call for participation - Adaptive and Resilient Computer Security

From Matthew Williamson (formerly of HP Labs, now at Sana Security, researcher behind the virus throttle idea) comes this call for participation:

ARCS 2005 is the fourth meeting of a workshop designed to bring together senior industrial researchers, policy makers and leading academics in the area of adaptive approaches to computer security. The format of the meeting is two days of presentations and discussions. It is sponsored by the Santa Fe Institute, and British Telecom.

We are seeking high quality presentations that can educate and stimulate discussion. In order to attend, please submit a 2-4 page paper to the Program Chair. The deadline for submissions is July 31st 2005. The topic areas of relevance are broadly in adaptive and biologically inspired approaches to all aspects of computer security:

• Buffer overflow mitigation
• Worm and virus containment
• Anti-virus & Anti-spyware
• Denial of service protection
• Effects of diversity
• Immunological approaches
• Topological effects in computer networks
• Machine learning and defence strategies
• Design of self-healing networks
• Alternative models – economic, + predator/prey

This year’s workshop will again be held at the Santa Fe Institute, in a superb setting with opportunities to interact with the resident world-class researchers. In addition the event precedes the annual SFI Business Network meeting on 4-5th Nov., to be held in Santa Fe, and attendees will have an opportunity to also register for this event.

Source: Adaptive and Resilient Computing Security Workshop (ARCS2005), 2nd & 3rd Nov. 2005, Santa Fe Institute, New Mexico, USA.

Inoculating SSH Against Address-Harvesting Worms

An interesting paper, and an idea that's been around for a while. Remember that the Morris worm (1988) used the Berkeley r commands and the trusted hosts.equiv setup to move between some hosts. The authors of this paper claim that much the same can be done using SSH keys because many are stored without passphrases.

Address harvesting is the act of searching a compromised host for addresses of other hosts to attack. Secure Shell (SSH), the tool of choice for administering and communicating with mission-critical hosts, securitycritical hosts, and even some routers, leaves each user’s list of previously contacted hosts open to harvest by anyone who compromises the user’s account. Attackers have combined address harvesting with myriad mechanisms for impersonating a host’s legitimate users to obtain a remote shell via SSH. They have succeeded in breaching systems at major academic, commercial, and government institutions. In this paper, we detail the threat posed should attackers automate this mode of attack to create a self-propagating worm. We then present a countermeasure to defend against address harvesting attacks, with an implementation written for OpenSSH. We also present the first study to measure how much information is available to attackers who harvest addresses from users’ known hosts databases and search for unencrypted identity key files. We found that a surprisingly large fraction of the known hosts entries were to hosts on distant networks, that the bulk of these entries could be reached by compromising a small fraction of the user accounts in our survey, and that 62.8% of identity keys encountered were stored unencrypted.

Source: Inoculating SSH Against Address-Harvesting Worms, Stuart E. Schechter, Jaeyeon Jung, Will Stockwell, and Cynthia McLain.

Thanks, Toby, for pointing me at the Bruce Schneier post on this topic.

Measuring and Modeling Computer Virus Prevalence

Another paper that asks very fundamental questions. For those of you who wonder about measuring virus prevalence, this is a paper to read for a good background. Every AV vendor lists the prevalence when they asses the threat posed by a virus or worm.

In an effort to understand the current extent of the computer virus problem and predict its future course, we have conducted a statistical analysis of computer virus incidents in a large, stable sample population of PCs and developed new epidemiological models of copmuter virus spread. Only a small fraction of all known viruses have appeared in real incidents, partly because many viruses are below the theoretical epidemic threshold. The observed sub-exponential rate of virual spread can be explained by models of localized software exchange. A suprisingly small fraction explained by a model in which, once a machine is found to be infected, neighboring machines are checked for viruses. This "kill signal" idea could be implemented in networks to greatly reduce the threat of viral spread. A similar principle has been incorporated into a cost-effective anti-virus policy for organizations which works qiute well in practice.

Source: Measuring and Modeling Computer Virus Prevalence, by Jeffrey O. Kephart and Steve R. White, from Proceedings of the 1999 IEEE Computer Society Symposium on Research in Security and Privacy, Oakland, California, May 24-25, 1993; pp.2-14.

The Future of Viruses on the Internet (1997)

This is an interesting paper to read now, over 8 years later, because it asks fundamental questions about the near term future we can currently answer. In a nutshell, the growing network provided by the Internet, software that utilizes the network, and broadband (an "always on" connection) did give the malware author a new , fertile ground to play in.

There are many different phenomena, both natural and man-made, that come in different sizes. In many cases, the small things come quite often, and the big things only rarely. Small earth tremors are much more common than large earthquakes. Slight rises in the level of a river are much more common than floods. Virus incidents that involve only a few machines are much more common than major outbreaks involving hundreds of systems ...

How will the continued growth of the Internet change the pattern of virus spread and similar threats? Is our current paradigm of virus containment sufficient for the future?

Source: The Future of Viruses on the Internet, by David Chess. This paper was originally presented at the Virus Bulletin International Conference in San Francisco, California, October 1-3, 1997.

Quarantining DHCP clients to reduce worm infection risk

This paper, a practical written for a SANS certification examination, extends the quarantine mechanism to DHCP clients. This "walled garden" approach is used by some providers and enterprises already, and this paper is a decent introduction to the topic.

“An ounce of prevention is worth a pound of cure”

Today’s highly connected computer systems are vulnerable to being attacked by "worm" programs which attempt to exploit software vulnerabilities and spread themselves between computers connected over networks.

“A computer worm is a self-replicating computer program,”

Most of these worms are malicious and cause serious problems for computer users. Estimates for the cost of recovery from damage done by computer worms ranges from the tens of thousands to the millions of dollars [1,9,12] per worm attack. “Estimated cost of damage caused by the Morris Worm:$15.5 million”

“Bank of America Corp., one of the nation's largest banks, said many customers could not withdraw money from its 13,000 ATMs because of technical problems caused by the attack”

“The cost of this epidemic, including subsequent strains of Code-Red, is estimated to be in excess of $2.6 billion”

This paper outlines an approach of preventing machines with infections from being allowed to connect using DHCP [7] into working networks by introducing a quarantine network that shares the same existing physical network already in use. The focus of this paper is checking for worm problems on DHCP client machines rather than machines with static hostnames and static IP addresses. This is presented as another layer in the “Defense in depth” approach to protecting an organization’s computer resources. There is no single “silver bullet” that will solve all the problems of worms causing damage but using several techniques including the one described in this paper will collectively reduce the risk. This paper does not address the problem of dis-infecting a worm infected machine.

Source: Quarantining DHCP clients to reduce worm infection risk, Paul Blackburn.

Collapsar: A VM-Based Architecture for Network Attack Detention

This presentation introduces a scalable overlay system much like yesterday's Honeyfarm idea.

Collapsar is different from current approaches. In (an) overlay based approach like NetBait or Domino Overlay, honeypots are deployed in different networks. Log information generated by these honeypots are securely aggregated so that advanced date mining techniques can be applied.  However, those attacks still happen within those sites.

Source: Collapsar: A VM-Based Architecture for Network Attack Detention, Xuxian Jiang,  Dongyan Xu, presented at USENIX Security 2004.

How many ways to 0wn the Internet? Towards Viable Worm Defenses

A presentation from Nicholas Weaver (the Warhol worm author) about the Honeyfarm idea.

Computer worms, autonomous programs which can spread through a computer network, represent a substantial threat to our computing infrastructure.  With the release of Sapphire/Slammer, very fast computer worms are now a real, not theoretical threat.  Such worms easily outpace human defenses.  Any robust defense will require automatic detection, analysis, and response mechanisms.

To create these defenses, we first must understand the strategies attackers could employ.  Fortunately, there seem to be only a few mechanisms which worms can use to find new targets: random selection, external, pregenerated, and internal target lists, and passive techniques.  Some of these techniques have been used before, while others represent novel strategies.  Understanding these techniques, it becomes possible to construct detectors, analysis tools, and response mechanisms.  We then discuss in detail one of our proposed detector/analysis system, wormholes and a honeyfarm.  This detector would be highly sensitive to worm activity.

Source: How many ways to 0wn the Internet? Towards Viable Worm Defenses [PPT], Nicholas Weaver.

In Depth Bagle Analysis

Jason Gordon, who runs the Infection Vectors website (a great complement to Wormblog, by the way), has written an in depth analysis of the Bagle worm. This is a good continuation of the writeup posted yesterday from Kaspersky Labs.

Beagle.A was discovered in late January 2004 and was an immediate success, spreading across the globe with a very simple infection strategy: just sending the worm as an attachment to a plain email message. Over the course of the spring, Beagle ran up over two dozen variants and thousands of compromised hosts.

Infectionvectors has published two in-depth reviews of Beagle and its development history, for details and commentary on the worm, see the first report, part two, and part three.

Beagle returned from a brief hiatus in early July 2004 with variants that attacked Internet hosts with a renewed ferocity. With even more success than previous versions, Beagle.X, AA, AB, and AO made special imprints on clients around the world, turning them into mail relaying robots.

Source: Beagle Alert, published on infectionvectors.com in March, 2005.

Design of a System for Real-Time Worm Detection

Another new worm detection mechanism. I like this approach, too, it seems to focus on one of the attributes that is a key differentiator of static worms compared to normal traffic, namely the increase in the same payload across observations in a short period of time. Note that you have to do some analysis to differentiate a worm from a flash crowd (the Slashdot effect) for example.

Recent well publicized attacks have made it clear that worms constitute a threat to Internet security. Systems that secure networks against malicious code are expected to be a part of critical Internet infrastructure in the future. Intrusion Detection and Prevention Systems (IDPS) currently have limited use because they can filter only known worms. In this paper, we present the design and implementation of a system that automatically detects new worms in real-time by monitoring traffic on a network. The system uses Field Programmable Gate Arrays (FPGAs) to scan packets for patterns of similar content. Given that a new worm hits the network and the rate of infection is high, the system is automatically able to detect an outbreak. Frequently occuring strings in packet payloads are instantly reported as likely worm signatures.

Source: Design of a System for Real-Time Worm Detection, Bharath Madhusudan, John Lockwood.

Distributed Worm Simulation with a Realistic Internet Model

Another PADS paper, this one by researchers at the University of Delaware. I like this paper because they have developed a simulation framework much like the one I was hoping to have, which modeled topology and bandwith together to try and understand worm propoagation dynamics.

Internet worm spread is a phenomenon involving millions of hosts, who interact in complex and diverse environment. Scanning speed of each infected host depends on its resources and the defenses at work in its network. Aggressive worms further interact with the underlying Internet topology---the dynamics of the spread is constrained by the limited bandwidth of network links, and high-volume scan traffic leads to BGP router failure thus affecting global routing. Worm traffic also interacts with legitimate background traffic competing for (and often winning) the limited bandwidth resources. To faithfully simulate worm spread and other Internet-wide events such as DDoS, flash crowds and spam we need a detailed Internet model, a packet-level simulation of relevant event features, and a realistic model of background traffic on the whole Internet. The memory and CPU requirements of such simulation exceed a single machine's resources, creating a need for distributed simulation. We propose a design and present implementation of a distributed worm simulator, called PAWS. PAWS runs on Emulab testbed, which facilitates its use by other researchers. We validate PAWS in a variety of scenarios, and evaluate costs and benefits of distributed worm simulation.

Source: Distributed Worm Simulation with a Realistic Internet Model, Sonjie Wei, Jelena Mirkovic, Martin Swany.

Software Diversity as a Defense against Viral Propagation: Models and Simulations

Several months ago, at the suggestion by David Nicol, we posted the call for papers for the PADS workshop. Nichols wrote me again to say that papers are up, and several worm papers are included in the lineup, and they look very good. The conference, 19th ACM/IEEE/SCS Workshop on Principles of Advanced and Distributed Simulation (PADS 2005), will be held on June 1-3, 2005, in Monterey, CA., USA. Nicol also notes, "We've made the registration costs as low as we can - particularly for students -in order to make it attractive for those in the Monterey, Santa Cruz, and Bay Areas. Important dates to remember are

   
• May 4 -- early registration cutoff date
• May 10 (5 p.m. PST) hotel conference rate cutoff date."

Over the next few days I'll be posting several of the abstracts and links to the papers. The first one is from two researchers examining a very fundamental question in computer and network security, diversity. O'Donnell is a friend of mine, and I've read various drafts of his work in other areas. It's a rigorous treatment of a relatively simple question with a complex answer.

The use of software diversity has often been discussed in the research literature as an effective means to break up the software monoculture present on the Internet and to thus prevent malcode propagation. However, there have been no quantitative studies that examine the effectiveness of software diversity on viral propagation. In this paper, we study both real (an IPv6 BGP topology) and synthetically generated (an Erdos-Renyi random graph) network topologies and employ a popular metric called the epidemic threshold to measure resistance to viral propagation in the presence of software diversity. We show that one can increase the epidemic threshold of a network even with a naive, random distribution of diverse software on the nodes of a network. We also show that an algorithm-driven diversity assignment further increases the epidemic threshold. These results confirm the value of strategic topology-sensitive assignment of diversity to improving the tolerance of a network to malcode propagation.

Source: Software Diversity as a Defense against Viral Propagation: Models and Simulations, Adam O'Donnell, Harish Sethu. Interested readers will want to see this paper  for more background information.

Worm Hotspots: Explaining Non-Uniformity in Worm Targeting Behavior

I like this paper a lot, not simply because I know the authors, but because it's an interesting finding that goes a long way towards showing us some of the inherent limitations in our measurement methodologies. It also challenges some of the assumptions we've worked with for a few years and shows the aggregate power of lots of packets flying around.

Long after the Blaster, Slammer/Sapphire, and CodeRedII worms caused significant worldwide disruptions, a huge number of infected hosts from these worms continue to probe the Internet today. This paper investigates hotspots (non-uniformities) in the targeting behavior of these important Internet worms. Recent data collected over the period of a month and a half using a distributed blackhole data collection infrastructure covering 18 networks including ISPs, enterprises, and academic networks show 75K Blaster infected hosts, 180K slammer infected hosts, and 55K CodeRedII hosts. We discover through detailed analysis how critical flaws and side effects in the targeting behavior lead to a significant bias for certain destination address blocks. In particular, we demonstrate three previously unexplored biases: a severely restricted initial random seed forcing infection attempts to certain blocks; flaws in the parameters of a random number generator making certain hosts cycle through limited target addresses; and the widespread use of private address space dramatically changing the targeting distribution of certain worms. A direct consequence of these biases is that certain blocks are subjected to far more infection attempts than others. We discuss the implication of these hotspots on worm simulation and modeling, placement of blackhole sensors, worm detection and quarantine.

Source: Worm Hotspots: Explaining Non-Uniformity in Worm Targeting Behavior, Evan Cooke, Z. Morley Mao, Farnam Jahanian.

Analyzing Worms and Network Traffic using Compression

An interesting paper pointed out by Rafael R Obelheiro. It uses the basic premise of redundancy being obvious under compression. Using this, the authors can determine if malware binaries are possibly related:

Internet worms have become a widespread threat to system and network operations. In order to fight them more efficiently, it is necessary to analyze newly discovered worms and attack patterns. This paper shows how techniques based on Kolmogorov Complexity can help in the analysis of internet worms and network traffic. Using compression, different species of worms can be clustered by type. This allows us to determine whether an unknown worm binary could in fact be a later version of an existing worm in an extremely simple, automated, manner. This may become a useful tool in the initial analysis of malicious binaries. Furthermore, compression can also be useful to distinguish different types of network traffic and can thus help to detect traffic anomalies: Certain anomalies may be detected by looking at the compressibility of a network session alone. We furthermore show how to use compression to detect malicious network sessions that are very similar to known intrusion attempts. This technique could become a useful tool to detect new variations of an attack and thus help to prevent IDS evasion. We provide two new plugins for Snort which demonstrate both approaches.

Source: Analyzing Worms and Network Traffic using Compression, Stephanie Wehner.

A Public Health Approach to Preventing Malware Propagation

From Kamal, a very interesting story about a masters thesis.

In the MIT Technology Review blog, a very interesting post from Simson Garfinkel entitled A Public Health Approach to Preventing Malware Propagation. He points to a thesis with that name from Kim Zelonis, which provides a novel look at the walware propagation problem. Zelonis' thesis is described as such:

The problem of malicious software (malware) is escalating to pandemic proportions. The enormity of the threat is evident by continual increases in four malware attributes: frequency of incidents, speed of propagation, damage done or intended, and the universality of the impact. Continuation of this trend threatens all systems dependent on the Internet.

Technological solutions to the malware problem have been long in coming and are likely to be vulnerable to be vulnerable to human action or inaction. As long as computer operation is a combination of technological capabilities and human control, a malware defense needs to combine these elements as well. Unfortunately, the computer security industry as a whole has made little effort to modify the risky behaviors adopted by the average computer user.

The public health discipline consistently combines scientific solutions and human interventions to prevent the spread of disease. One clear example of this has been the fight against HIV/AIDS. Medical technologies to treat and prevent HIV/AIDS have been strategically combined with behavioral interventions and awareness campaigns. By analyzing the effective elements of interventions that modify behaviors that enable the spread of HIV/AIDS, we can identify strategies for modifying the user behaviors that enable the spread of malware.

Just as there is little likelihood of eliminating all disease, it is unlikely that malware can be completely eliminated. However, effective strategies can keep malware outbreaks to controllable levels. This paper proposes analogous solutions to combined behavioral and technological approaches to fighting the malware epidemic based on successful strategies in the HIV/AIDS epidemic. These generally involve applying common characteristics and monitoring methodologies from public health interventions. Technology solutions should still be pursued but with the intent of working in combination with user behavioral strategies.

Source: A Public Health Approach to Preventing Malware Propagation, a masters thesis from Kim Zelonis.

As Kamal notes, it's a very novel approach to thinking about the problem. Figures 3 ("Summary of Analogous Attributes") and 6 ("Summary of Disanalogous Attributes") are really part of the core thinking in the work. However, it's a bit lacking in the cost to measure during propagation or the after effects.

Lifecycle of an E-mail Worm

I don't think I run enough on mass mailer worms. I typically gloss over them, thinking that they're relatively easy to do an rarely represent a challenge for detection or development. After all, if you spam enough of the same mail to everyone, enough people will click on the attachments and eventually you have the possibility for self-replicating code. No big deal. Detecting them is somewhat interesting (a couple of papers are coming up discussing some interesting methos), but is rarely considered. Most people say "just use server-based AV products". That works once a signature is out, but that can be hours away, once significant damage is done. Hence, I keep focusing on de novo worm detection mechanisms, identifying and characterizing the threat in the absence of a known signature. This article is one of the better articles on mass mailer worms I've seen.

The only “secret” malicious coders understand is how to write a program designed to seek out and manipulate other system files or applications. Instead of writing a word-processing app that opens documents, they tell their creations to open executables and do devious things. I’m going to take you on a well-traveled adventure surrounding a fictitious, but reasonably representative, e-mail worm. In the process, I’ll explain how a malicious mobile code program is conceived, initiated and spread and show how the computer security community responds. In short, I’ll cover the lifecycle of a typical e-mail worm.

Source: Lifecycle of an E-mail Worm, July 2003 by Roger A. Grimes.

Efficient Content-Based Detection of Zero-DayWorms

An interetsing paper, and an approach that will break down (I suspect) in the face of polymorphic worms and threats.

Recent cybersecurity incidents suggest that Internet worms can spread so fast that in-time human-mediated reaction is not possible, and therefore initial response to cyberattacks has to be automated. The first step towards combating new unknown worms is to be able to detect and identify them at the first stages of their spread. In this paper, we present a novel method for detecting new worms based on identifying similar packet contents directed to multiple destination hosts. We evaluate our method using real traffic traces that contain real worms. Our results suggest that our approach is able to identify novel worms while at the same time the generated false alarms reach as low as zero percent.

Source: Efficient Content-Based Detection of Zero-Day Worms, P. Akritidis, K. Anagnostakis, E. P. Markatos.

Application of Hardware Accelerated Extensible Network Nodes for Internet Worm and Virus Protection

While I'm not big on hardware designs (I just simply don't know much about it), this paper is an interesting use of programmable hardware to do high speed traffic analysis. While the authors use FPGAs, you can probably get by with an NPU or, even a GPU with the right interface to the network. What I don't like about the paper is that it requires everyone to deploy it to be effective. That's an unrealistic requirement, or even an unreasonable goal.

Today's crucial information networks are vulnerable to fastmoving attacks by Internet worms and computer viruses. These attacks have the potential to cripple the Internet and compromise the integrity of the data on the end-user machines. Without new types of protection, the Internet remains susceptible to the assault of increasingly aggressive attacks. A platform has been implemented that actively detects and blocks worms and viruses at multi-Gigabit/second rates. It uses the Field-programmable Port Extender (FPX) to scan for signatures of malicious software (malware) carried in packet payloads. Dynamically reconfigurable Field Programmable Gate Array (FPGA) logic tracks the state of Internet flows and searches for regular expressions and fixed strings that appear in the content of packets. Protection is achieved by the incremental deployment of systems throughout the Internet.

Source: Application of Hardware Accelerated Extensible Network Nodes for Internet Worm and Virus Protection, John W. Lockwood, James Moscola, David Reddick, Matthew Kulig, and Tim Brooks. Also see a very related paper, Design of a System for Real-TimeWorm Detection, by some of the same authors.

Defending Against Internet Worms: A Signature-Based Approach

Not an uncommon goal or project, the automated generation of worm traffic signatures, but an intersting approach to the problem. You'll see a few techniques that aren't so common and what appears to be a unique "double honeypot" approach.

With the capability of infecting hundreds of thousands of hosts, worms represent a major threat to the Internet. The defense against Internet worms is largely an open problem. This paper attempts to answer two important questions. Can a localized defense system detect new worms that were not seen before and, moreover, capture the attack packets? How to identify polymorphic worms from the normal background traffic? We have two major contributions. The first contribution is the design of a novel double-honeypot system, which is able to automatically detect new worms and isolate the attack traffic. The second contribution is the introduction of position-aware distribution signature (PADS), which fits in the gap between the traditional signatures and the anomaly-based systems. We propose two algorithms based on Expectation-Maximization (EM) and Gibbs Sampling for efficient computation of PADS from polymorphic worm samples. The new signature is capable of handling certain polymorphic worms. Our experiments show that the algorithms accurately separate new variants of the MSBlaster worm from the normal background traffic.

Source: Defending Against Internet Worms: A Signature-Based Approach, Yong Tang and Shigang Chen.

An Internet-Worm Early Warning System

This is an interesting paper. Unlike a lot of scan detection systems, it looks at the reply traffic from the targets, as opposed to the stimulus traffic from the sources. It also makes use of allocated address space, which everyone has (as opposed to dark address space, which is uncommon).

We propose an Internet-worm early warning system, which integrates a set of novel techniques that automatically detect the concerted scan activity of an on-going worm attack. It is able to issue warning at the early stage of worm propagation and to provide necessary information for security analysts to control the damage. The system monitors a “used” address space. Unlike the traditional approach that keeps track of SYN packets, it relies on RESET packets to find the scan sources, which has greater accuracy and less overhead. The system is resilient to anti-monitor measures. Particularly, a sophisticated protocol is designed to distinguish faked scan sources from real scan sources. We provide an analytical study on the properties and effectiveness of this early warning system, and back up our claims by numerical results.

Source: An Internet-Worm Early Warning System, Shigang Chen and Sanjay Ranka.

Development of Computer Vulnerability Scanning Scanning Workgroup

I like this writeup because it's practical, effective, and something you can begin thinking about if you operate networks. By recognizing the greater good here (unproblematic access for as many as possible), the architects of this plan were given the freedom to act and empowered to make changes.

During fall 2003, a large scale Internet worm exploited a widely known Windows operating system vulnerability throughout academic institutions in the United States. This worm infection (W32.Blaster) presented serious risks to the integrity and availability of computing systems attached to the campus network. In response to this vulnerability, UC Davis developed and implemented several emergency measures to identify susceptible Windows remote procedure call (RPC) services and provide corrective tools and information to remove the vulnerability or, if necessary, disinfect worm infected computers.

Source: Development of Computer Vulnerability Scanning Scanning Workgroup, University of California, Davis, Draft Report - April 19, 2004.

EPOCalypse NOW! (The Explosion of Win32 Worm Threats)

A valuable, but short, perspective from the very respectable Peter Szor:

So what has happened to the virus-writing landscape in 2004? Well, the number of Win32 virus threats this year grew by a whopping 300% over the same period last year, resulting in almost 4,500 variants this year so far. That said, there were a total of 5,500 Win32 creations in 2003. I am not going to get into the ‘good old days’ talk, but in 2001 (the year of CodeRed and Nimda) there were 741 new Win32 variants during the entire year. In contrast, there were over 700 new Win32 variants during just the first two weeks of June 2004. Thus, the volume of malicious code seems to be growing quicker than ever, and virus writers do not appear to be afraid of creating more. The question is: would the situation be even worse without Microsoft’s reward announcements?

Source: EPOCalypse NOW! (The Explosion of Win32 Worm Threats), Virus Bulletin, July 2004, page 2.

He's recently written a book, The Art of Computer Virus Research and Defense. You can read a sample chapter, Strategies of Computer Worms, to get a flavor of the book. It's very valuable, a compendium of knowledge that is sure to set the standard for a long time to come.

The Use of Honeynets to Detect Exploited Systems Across Large Enterprise Networks

Another paper that analyzes the efficacy of a honeypot deployment on actually curtailing malicious traffic. This paper gives you some insight into the data management techniques, too, for large-scale honeypot and honeynet deployments.

Computer Networks connected to the Internet continue to be compromised and exploited by hackers. This is in spite of the fact that many networks run some type of security mechanism at their connection to the Internet. Large Enterprise Networks, such as the network for a major university, are very inviting targets to hackers who are looking to exploit networks. Large Enterprise Networks may consist of many machines running numerous operating systems. These networks normally have enormous storage capabilities and high speed/high bandwidth connections to the Internet. Due to the requirements for Academic Freedom, system administrators are restricted in what requirements they can place on users on these networks. The high bandwidth usages on these networks make it very difficult to identify malicious traffic within the enterprise network. We propose that a Honeynet can be used to assist the system administrator in identifying malicious traffic on the enterprise network. By its very nature, a Honeynet has no production value and should not be generating or receiving any traffic. Thus, any traffic to or from the Honeynet is suspicious in nature. Traffic from the enterprise network to a machine on the Honeynet may indicate a compromised enterprise system.

Source: The Use of Honeynets to Detect Exploited Systems Across Large Enterprise Networks, John Levine, Richard LaBella, Henry Owen, Didier Contis, Brian Culver. From: Proceedings of the 2003 IEEE Workshop on Information Assurance, United States Military Academy, West Point, NY June 2003.

Worm Meets Beehive

I like this paper because it not only demonstrates a method, but it analyses the effectiveness of such a proposal. Study this one closely, the methods and findings are very interesting.

Internet worms continue to plague the Internet infrastructure with wider and deeper impact since the Morris Worm in early 1988. It has been further shown that better-engineered worms like Warhol worms and Flash worms could spread across the Internet in minutes or even tens of seconds rather than hours. Such virulent spreading invalidates any manual counter-measures and poses an extremely serious threat to the safety of the Internet.

To address this challenge, this paper proposes a novel worm-curtailing scheme, i.e., beehive, which is able to fightback worm propagation by actively immunizing any encountered worm-infected node. More specifically, by owning a portion of the unused but routable IP space that is open to infection attempts of different worms, a beehive not only attracts and traps these attempts, but also defensively gives a security shot to each attempting worm-infected node. The security shot will immunize the infected node so that the node will not be able to infect others. Our formal analysis shows that even one beehive network with a reasonable IP address space can effectively mitigate active spreading of worms among a million nodes. This paper presents both analysis and simulation results of beehive evaluation. Particularly, our results show that for a random-probing worm, a beehive network or 8 class B networks are able to reduce the maximum worm infection coverage to as low as 13%. To the best of our knowledge, no such worm fightback mechanism has been proposed and analyzed before. Finally, a beehive prototype is presented to demonstrate its practicality.

Source: Worm Meets Beehive, Xuxian Jiang, Dongyan Xu, Shan Lei, Paul Ruth and Jianzhong Sun.

Honey, I caught a worm: Building yourself a honeypot, some practical issues

This is a tutorial on setting up a honeypot using a RedHat 6.2 system. While dated, these instructions can easily be modified for use on a current Linux system. Note that the choice of platform for your honeypot will be important, as you don't want to give away too much information about the host platform and you don't want it to be an obvious honeypot.

CodeRed and Blue, Nimda I and II, Linux BIND worms, they are now all part of Internet history and folklore. At the time of their breakout however, these worms created a lot of problems, chaos and headaches for system administrators, network administrators and security people, and we all hope everybody has learned from these happenings.

Chances are that such an outbreak can happen again due to a great many factors, amongst which the complexity of the software used nowadays, the inevitable bugs therein, the time constraints of administrators and a lack of information on security issues. So to prevent the same problems, chaos and headaches from happening again a number of things can and must be done. One of the more fun things one can do to keep up to date with current security affairs, is to build a honeypot. The excellent Honeynet project (http://project.honeynet.org/) is a great resource for people wanting to build a honeypot. This paper describes the practical steps the author has taken to build a honeypot, catch worms and other exploits and what to do afterwards. And of course, there are a number of points for improvement (aren.t there always ?).

Source: Honey, I caught a worm: Building yourself a honeypot, some practical issues, Arthur Donkers.

J-Honeypot: A Java-Based Network Deception Tool with Monitoring and Intrusion Detection

A second paper and tool combination, this one introduces a Java version of Honeyd. Note that the project JHoney is found on SourceForge.

In this paper, we describe the development of J-Honeypot, a Java-based network deception tool with a web-based monitoring interface and a rule-based intrusion detection engine. Our J-Honeypot is based on the Honeyd program by Niels Provos, but features important enhancements. First, since J-Honeypot is written in Java, it can potentially run on various platforms, windows or UNIX, workstations or handheld devices. Second, J-Honeypot has a rule-based intrusion detection engine, whose design is guided by the analysis of real world attack data. The attack data was collected by opening up our J-Honeypot to solicit possible attacks. Third, J-Honeypot includes a web-based monitoring tool that is easily accessible and can help network administrators better understand network traffic and possible attacks.

Source: J-Honeypot: A Java-Based Network Deception Tool with Monitoring and Intrusion Detection , Yuqing Mai,  Radhika Upadrashta, Xiao Su.

A Virtual Honeypot Framework

This paper introduces honeyd, which needs no further introduction.

A honeypot is a closely monitored network decoy serving several purposes: it can distract adversaries from more valuable machines on a network, can provide early warning about new attack and exploitation trends, or allow in-depth examination of adversaries during and after exploitation of a honeypot. Deploying a physical honeypot is often time intensive and expensive as different operating systems require specialized hardware and every honeypot requires its own physical system. This paper presents Honeyd, a framework for virtual honeypots that simulates virtual computer systems at the network level. The simulated computer systems appear to run on unallocated network addresses. To deceive network fingerprinting tools, Honeyd simulates the networking stack of different operating systems and can provide arbitrary routing topologies and services for an arbitrary number of virtual systems. This paper discusses Honeyd’s design and shows how the Honeyd framework helps in many areas of system security, e.g. detecting and disabling worms, distracting adversaries, or preventing the spread of spam email.

Source: A Virtual Honeypot Framework, Niels Provos.

Honeycomb - Creating Intrusion Detection Signatures Using Honeypots

This is one of my favorite methods to emerge from honeypot data analysis. Christian Kreibich, a graduate student at the University of Cambridge in the UK, has created two tools, a library (libstree) and a tool (honeycomb) which can be used to generate IDS signatures automatically.

This paper describes a system for automated generation of attack signatures for network intrusion detection systems. Our system applies pattern-matching techniques and protocol conformance checks on multiple levels in the protocol hierarchy to network traffic captured a honeypot system. We present results of running the system on an unprotected cable modem connection for 24 hours. The system successfully created precise traffic signatures that otherwise would have required the skills and time of a security officer to inspect the traffic manually.

Source: Honeycomb - Creating Intrusion Detection Signatures Using Honeypots.

Honetnet report: Internet Worms

A writeup of a worm captured by a honeypot. While it's a bit short on details of how the analysis was done, it does reveal the powerful insight you get from using a honeypot to track worm activity.

A worm attack captured by the Honeynet Project in recent times is a good example of how exactly these worms work and gives us a good indication as to what can be done to prevent them. This month we will analyse a worm infection of a windows 98 home computer. If the google search engine’s statistics are a good indicator of the prevalence of a given operating system almost one quarter, or 24%, of computers on the Internet are still running the Windows 98 operating System and many of these have a dedicated broadband Internet connection.

Source Internet Worms, a HoneyNet report from the HoneyNet group in Ireland.

HoneyStat: LocalWorm Detection Using Honeypots

The next series of papers are going to look at honeypots and their roles in detecting and countering network worms. Many people like to use honeypots as detection systems, but there's a bit of an art to it. For effective scan and worm detection, you can't simply stick a box up on an IP address and hope it works, you really have to architecture it right. Secondly, once you have a honeypot, you'll want to monitor it and track what you find. And thirdly, you can do a few interesting things with honeypots, since you control ther target.

A couple of links before we begin:

• An earlier piece on ForeScout, who used a honeypot to track a new worm.
• Have a look at Malware Blog, Eric Johansen's blog about his ongoing research into network malware using honeypots. He's always writing something new, great information.
• The HoneyTank architecture falls into the honeypot discussion and is worth a review, too.
• SMB Lure is effectively a Windows filesharing honeypot, also great for tracking Windows worms.
• For a great description of how you can create a malicious honeypot, have a look at Towards Evil Honeypots?! When they bite back ... by Laurent Oudot, presented in spring 2004 at CanSecWest.

And now, on to the paper series. We'll cover actual honeypot tools, papers that show how they react to worms, and the like.

Worm detection systems have traditionally used global strategies and focused on scan rates. The noise associated with this approach requires statistical techniques and large data sets (e.g., 220 monitored machines) to yield timely alerts and avoid false positives. Worm detection techniques for smaller local networks have not been fully explored.

We consider how local networks can provide early detection and compliment global monitoring strategies. We describe HoneyStat, which uses modified honeypots to generate a highly accurate alert stream with low false positive rates. Unlike traditional highly-interactive honeypots, HoneyStat nodes are script-driven, automated, and cover a large IP space.

The HoneyStat nodes generate three classes of alerts: memory alerts (based on buffer overflow detection and process management), disk write alerts (such as writes to registry keys and critical files) and network alerts. Data collection is automated, and once an alert is issued, a time segment of previous traffic to the node is analyzed. A logit analysis determines what previous network activity explains the current honeypot alert. The result can indicate whether an automated or worm attack is present.

We demonstrate HoneyStat’s improvements over previous worm detection techniques. First, using trace files from worm attacks on small networks, we demonstrate how it detects zero day worms. Second, we show how it detects multi vector worms that use combinations of ports to attack. Third, the alerts from HoneyStat provide more information than traditional IDS alerts, such as binary signatures, attack vectors, and attack rates. We also use extensive (year long) trace files to show how the logit analysis produces very low false positive rates.

Source: HoneyStat: Local Worm Detection Using Honeypots, David Dagon, Xinzhou Qin, Guofei Gu,Wenke Lee, Julian Grizzard, John Levine, and Henry Owen.

A Network Worm Vaccine Architecture

This is the same group that I posted about earlier with the aproach of countering worms with patches.

The ability of worms to spread at rates that effectively preclude human-directed reaction has elevated them to a first-class security threat to distributed systems. We present the first reaction mechanism that seeks to automatically patch vulnerable software. Our system employs a collection of sensors that detect and capture potential worm infection vectors. We automatically test the effects of these vectors on appropriately-instrumented sandboxed instances of the targeted application, trying to identify the exploited software weakness. Our heuristics allow us to automatically generate patches that can protect against certain classes of attack, and test the resistance of the patched application against the infection vector. We describe our system architecture, discuss the various components, and propose directions for future research.

Source: A Network Worm Vaccine Architecture, Stelios Sidiroglou and Angelos D. Keromytis.

Analyze the Worm-based Attack in Large Scale P2P Networks

Another paper looking at the modeling of epidemics (like worms) on P2P networks. This one is much shorter, however.

Peer-to-Peer (P2P) computing has become an interesting research topic during recent years. In this paper, we address issue related to analyzing the worm-based attack in P2P systems. Particularly, our technologies include: 1) generic mathematical models for attacker/defender and different P2P systems; 2) practical and effective attack prevention schemes. We find that our proposed defense strategy can efficiently improve the performance of worm detection and system recovery.

Source: Analyze the Worm-based Attack in Large Scale P2P Networks, Wei Yu.

Analyzing the Spread of Active Worms over VANET

This is the first paper of it's kind that I've seen. It marries traditional epidemic spreading models together  with network threat modeling to achieve a new, very relevant analysis. Make sure you look at this Slashdot story, Lexus Computers Infected Via Bluetooth, for just how serious a threat this can be.

Interactive communications among nodes in Vehicular Ad Hoc Networks (VANET) and the safety-oriented nature of many VANET applications necessitate a robust security framework. An active worm over VANET can, in addition to the well-known threats to information confidentiality, integrity and service availability, pose a whole new class of trafficrelated threats (ranging from congestion to large-scale accidents). This paper investigates the parameters governing the spread of active worms over VANET. To this end, we first define the average effective distance between two VANET vehicles using parameters of freeway traffic (such as velocity, time lag, number of lanes and traffic density). This effective distance measure is then used to describe the behavior of a VANET link as a log-normal shadow fading channel. The channel model is employed to define the VANET topology as a geometric random graph. We derive an analytic expression describing the average node degree of the VANET graph. The spread of a worm over VANET is modeled using a stochastic model of infectious diseases, namely the standard Susceptible, Infected, Removed (SIR) epidemic model. We run the stochastic SIR epidemic model on the VANET graph. For both congested and low-density traffic scenarios, we derive expressions for the rate of worm spread as a function of the average degree of the graph and the patching process. Analysis is provided for: 1) preemptive patching, where the number of patched VANET nodes remains constant; 2) interactive patching, where real-time patching is performed during a worm outbreak. We demonstrate that the latter can effectively curb the spread of a VANET worm in both congested and lowdensity traffic scenarios.

Source: Analyzing the Spread of Active Worms over VANET, Syed A. Khayam and Hayder Radha.

Internet Intrusions: Global Characteristics and Prevalence

I have a soft spot in my heart for large scale measurement projects. These guys know what they're doing.

Network intrusions have been a fact of life in the Internet for many years. However, as is the case with many other types of Internet-wide phenomena, gaining insight into the global characteristics of intrusions is challenging. In this paper we address this problem by systematically analyzing a set of firewall logs collected over four months from over 1600 different networks world wide. The first part of our study is a general analysis focused on the issues of distribution, categorization and prevalence of intrusions. Our data shows both a large quantity and wide variety of intrusion attempts on a daily basis. We also find that worms like CodeRed, Nimda and SQL Snake persist long after their original release. By projecting intrusion activity as seen in our data sets to the entire Internet we determine that there are typically on the order of 25B intrusion attempts per day and that there is an increasing trend over our measurement period. We further find that sources of intrusions are uniformly spread across the Autonomous System space. However, deeper investigation reveals that a very small collection of sources are responsible for a significant fraction of intrusion attempts in any given month and their on/off patterns exhibit cliques of correlated behavior. We show that the distribution of source IP addresses of the non-worm intrusions as a function of the number of attempts follows Zipf’s law. We also find that at daily timescales, intrusion targets often depict significant spatial trends that blur patterns observed from individual “IP telescopes”; this underscores the necessity for a more global approach to intrusion detection. Finally, we investigate the benefits of shared information, and the potential for using this as a foundation for an automated, global intrusion detection framework that would identify and isolate intrusions with greater precision and robustness than systems with limited perspective.

Source: Internet Intrusions: Global Characteristics and Prevalence, Vinod Yegneswaran, Paul Barford and Johannes Ullrich.

Broadband Network Virus Detection System Based on Bypass Monitor

While a short paper, it's a neat idea for an implementation.

Network virus are always detected in serial device such as router and firewall generally, limited to the performance of device, the effect virus impose on Internet cannot be detected accurately. To resolve this problem, we have developed a Virus Detection System (VDS) based on bypass monitor that can work on GE level network. With VDS, the virus can be detected in package or data stream according to four methods like binary, URL, E-mail, script. The statistical information of the virus including the virus name, source IP, target IP, spread times and the traffic are provided accurately and presented in charts.

Source: Broadband Network Virus Detection System Based on Bypass Monitor, Wu Bing, Yun Xiaochun, Xiao Xinguang. This paper appeared at the 2004 AAVAR conference.

A First Look at Peer-to-Peer Worms: Threats and Defenses

A conspiracy theorist might look at the author affiliations and think that Microsoft is attempting to discredit the P2P networks that are so popular. However, these networks provide an excellent breeding ground for epidemics such as worms and viruses, along with other forms of malware. Luckily, for most enterprise and SP networks, removing this traffic specifically is somewhat easy once a problem has erupted, unlike it would be for SMTP, HTTP or DNS traffic.

Peer-to-peer (P2P) worms exploit common vulnerabilities in member hosts of a P2P network and spread topologically in the P2P network, a potentially more effective strategy than random scanning for locating victims. This paper describes the danger posed by P2P worms and initiates the study of possible mitigation mechanisms. In particular, the paper explores the feasibility of a self-defense infrastructure inside a P2P network, outlines the challenges, evaluates how well this defense mechanism contains P2P worms, and reveals correlations between containment and the overlay topology of a P2P network. Our experiments suggest a number of design directions to improve the resilience of P2P networks to worm attacks.

Source: A First Look at Peer-to-Peer Worms: Threats and Defenses, Lidong Zhou, Lintao Zhang, Frank McSherry, Nicole Immorlica, Manuel Costa, and Steve Chien.

Simulating Internet Worms

Worm simulations are important, as you can't always rely on a worm to appear (and cause damage to the network), nor can you build out a totally realistic lab network. Frameworks to do this are uncommon, and the ones that do exist are somewhat limited or cumbersome. New improvements in this field are always welcome. Myself, I prefer to use DaSSFNet over ns, or other specific systems I build (but that aren't frameworks). I haven't explored many of the newer ones out there, sadly.

The accurate and efficient modeling of Internet worms is a particularly challenging task for network simulation tools. The atypical and aggressive behavior of these worms can easily consume excessive resources, both processing time and storage, within a typical simulator. In particular, the selection of random IP addresses, and the sending of packets to the selected hosts, even if they are non–existent or not modeled in the simulation scenario, is challenging for existing network simulation tools. Further, the computation of routing information for these randomly chosen target addresses defeats most caching or on–demand routing methods, resulting in substantial overhead in the simulator. We discuss the design of our Internet worm models in the Georgia Tech Network Simulator, and show how we addressed these issues.We present some results from our Internet worm simulations that show the rate of infection spread for a typical worm under a variety of conditions.

Source: Simulating Internet Worms, George F. Riley, Monirul I. Sharif, and Wenke Lee.

Optimal Control of Treatment Costs for Internet Worm

A rather straight forward paper which examines the costs during an epidemic outbreak from a network worm.

There has been a constant barrage of worms over the internet during the recent past. Besides threatening network security, these worms cause an enormous economic burden in terms of loss of productivity at the victim hosts. In addition, these worms create unnecessary network delay incurred by both infection and treatment which is the level of filtering. To develop appropriate tools for thwarting quick spread of worms, researchers are trying to understand the behavior of the worm propagation with the aid of epidemiological models. In this study, we have presented an optimization model that takes into account the infection and treatment costs. Using this model we can determine the level of treatment to be applied for a given rate of infection spread. The simulation study also shows the optimal level of treatment which should be chosen to minimize the total cost of infection and to reduce the current infection rate. This information could be usefully employed to choose hosts for quarantine to reduce the prospects of the spread of infection in the future.

Source: Optimal Control of Treatment Costs for Internet Worm Jonghyun Kim, Sridhar Radhakrishnan, and Sudarshan K. Dhall. This paper appeared at WORM04.

Slowing Down Internet Worms

I've taken a liking to solutions that attempt to slow down worms, rather than focusing on stopping them entirely. You'll never win, so why not try for something more tractable. This paper starts to bridge the epidemic models and the thoughts of slowing down worms.

An Internet worm automatically replicates itself to vulnerable systems and may infect hundreds of thousands of servers across the Internet. It is conceivable that the cyber-terrorists may use a wide-spread worm to cause major disruption to our Internet economy. While much recent research concentrates on propagation models, the defense against worms is largely an open problem.We propose a distributed anti-worm architecture (DAW) that automatically slows down or even halts the worm propagation. New defense techniques are developed based on behavioral difference between normal hosts and worm-infected hosts. Particulary, a worm-infected host has a much higher connection-failure rate when it scans the Internet with randomly selected addresses. This property allows DAW to set the worms apart from the normal hosts. We propose a temporal rate-limit algorithm and a spatial ratelimit algorithm, which makes the speed of worm propagation configurable by the parameters of the defense system. DAW is designed for an Internet service provider to provide the antiworm service to its customers. The effectiveness of the new techniques is evaluated analytically and by simulations.

Source: Slowing Down Internet Worms, Shigang Chen and Yong Tang. This paper appeared at ICDCS 2004.

Modelling a Computer Worm Defense System

A thesis which examines the mechanisms of detecting and countering Internet worms. While a sizable read, it's full of good information and references, too.

This thesis addresses the problem of computer worms in the modern Internet. A worm is a self­propagating computer program that is being increasingly and widely used to attack the Internet. This thesis begins by providing a model of a simple worm and an extensive background about worms of the past, present and future. It develops a model of a computer worm and discusses in length the aspects involved in defending the Internet against a worm. It explores several techniques toward this end. It develops a life cycle model of worm defense, including prevention, prediction, detection and mitigation. It also discusses in detail about each of these techniques. It develops innovative models for each of these techniques and analyzes each one of them. Of primary interest are models that can automatically respond to a worm outbreak. Two such mitigating models, the `friends' model' and the `hierarchical model' have been developed and discussed in addition to a predicting model, `TrendCenter'. It discusses the results of real time experiments conducted on the campus gateway for the `TrendCenter' effort and the results of simulations of the mitigation models. It also discusses several preventive models that have been developed by the community. It concludes that worms are dangerous to the Internet but there are ways and means to mitigate their ill­ effects

Source: Modelling a Computer Worm Defense System, from a thesis by Senthilkumar G. Cheetancheri.

A behavioral approach to worm detection

An interesting architecture proposal from the always intelligent Dan Ellis and coworkers at MITRE.

This paper presents a new approach to the automatic detection of worms using behavioral signatures. A behavioral signature describes aspects of any particular worm's behavior that are common across the manifestations of a given worm and that span its nodes in temporal order. Characteristic patterns of worm behaviors in network traffic include 1) sending similar data from one machine to the next, 2) tree-like propagation and reconnaissance, and 3) changing a server into a client. These behavioral signatures are presented within the context of a general worm propagation model. Taken together, they have the potential to detect entire classes of worms including those which have yet to be observed.

This paper introduces the concept of an network application architecture (NAA) as a way to distribute network applications. An analysis shows that the choice of NAA impacts the sensitivity of behavioral signatures. An NAA that satisfies certain constraints significantly improves worm detection sensitivity. Mathematical models of traffic flow, NAAs, worm propagation, and worm detection provide a context for the entire discussion.

Source: A behavioral approach to worm detection, by Daniel R. Ellis, John G. Aiken, Kira S. Attwood and Scott D. Tenaglia. Presented at WORM04.

Worm Propagation Modeling and Analysis under Dynamic Quarantine Defense

More modeling and analysis from the prolific Zou and Towsley, this time looking at the effect of "quarantine" measures on worm propagation.

Due to the fast spreading nature and great damage of Internet worms, it is necessary to implement automatic mitigation, such as dynamic quarantine, on computer networks. Enlightened by the methods used in epidemic disease control in the real world, we present a dynamic quarantine method based on the principle .assume guilty before proven innocent. . we quarantine a host whenever its behavior looks suspicious by blocking traffic on its anomaly port. Then we will release the quarantine after a short time, even if the host has not been inspected by security staffs yet. We present mathematical analysis of three worm propagation models under this dynamic quarantine method. The analysis shows that the dynamic quarantine can reduce a worm.s propagation speed, which can give us precious time to fight against a worm before it is too late. Furthermore, the dynamic quarantine will raise a worm.s epidemic threshold, thus it will reduce the chance for a worm to spread out. The simulation results verify our analysis and demonstrate the effectiveness of the dynamic quarantine defense.

Source: Worm Propagation Modeling and Analysis under Dynamic Quarantine Defense, by Cliff Changchun Zou, Weibo Gong, Don Towsley.

The Effect of Infection Time on Internet Worm Propagation

An interesting paper from a student that looks at worm propagation rates with respect to infection time. The relationship isn't as simple as one might assume.

When a worm is released onto the Internet, it spreads quickly, causing d age to computers and costing millions of dollars in lost revenue and re costs. Accurate models of worm spread can help computer scientists dev methods to limit the damage worms cause.

Current models assume computers are infected instantaneously. Howe worms are code that has to be downloaded. This takes time. Does the t takes to transfer a worm significantly effect the time it takes the w to spread? How slow does the network have to be before the transfer affects the worm.s spread? How large does the worm have to be? Does effect of scanning change the way we try to defend against worms?

Source: The Effect of Infection Time on Internet Worm Propagation, by Erika Rice. Also see an associated presentation [PDF].

A Firewall Network System for Worm Defense in Enterprise Networks

An excellent paper that examines the idea of "defense in depth" as related to worms, using very good methods and what appears to be a sound analysis.

From a security point of view, the Internet is too open. The central idea of a traditional “firewall” is to constrain service requests from the Internet to a local network. As an enterprise network becomes larger and more flexible, an Internet worm can easily find a way to enter it. Based on the “defense-in-depth” principle, we present a “Firewall Network System” for worm defense in enterprise networks, which uses internal firewalls to divide an enterprise network into many isolated subnetworks. Computers in an enterprise network are classified as either clients or servers: all service requests sent to internal IP addresses of an enterprise network will be blocked by internal firewalls if they target non-server computers or servers that do not provide the corresponding service. In this way, the Firewall Network System removes most worm infection paths in an enterprise network and makes worm detection much easier. All internal firewalls are designed to have the same set of firewall rules, which means the Firewall Network System is scalable and easily managed. In addition, we propose a five-level feedback worm defense strategy based on the US homeland defense “color” system [11] and present models of several worm defense techniques including active patching and individual quarantine.

Source: A Firewall Network System for Worm Defense in Enterprise Networks, Cliff C. Zou, Don Towsley, and Weibo Gong. Umass ECE Technical Report TR-04-CSE-01,  February 2004.

The Evolution of Viruses and Worms

Another paper that is a short history on worms and viruses. This paper mixes together mail based worms and network based worms, and looks at the evolution of their use. A decent paper, although incomplete by most measures, but the conclusion is valid (worm authors are using the worm as a malware distribution method), and one that I've been discussing for several years. This is a trend I saw starting in 1999, even, and it's only becoming more prevalent. This appears to be similar to an earlier paper by Chen of the same name (see Wormblog, Feb. 16).

Computer viruses and network worms have evolved through a continuous series of innovations, leading to the recent wave of fast-spreading and dangerous worms. A review of their historical development and recent outbreaks leads to a number of observations. First, while viruses were more common than worms initially, worms have become the predominant threat in recent years, coinciding with the growth of computer networking. Second, despite widespread use of firewalls and other network security equipment, worm outbreaks still occur and will likely continue to be a threat for the near future. Third, recent worms are appearing as a series of quick successive variants.  Unlike the independent efforts of early viruses, these variants suggest an increasing level of coordination among worm creators. Fourth, recent worms have shown capabilities to spread faster and exploit more infection vectors.  This trend implies a more urgent need for automated, coordinated protection measures. Finally, more dangerous payloads are becoming commonplace. This suggests that worm creators are using worms for other objectives than simply infection, such as data theft and setting up denial of service networks.

Source: The Evolution of Viruses and Worms, Thomas M. Chen and Jean-Marc Robert.

Using Predators to Combat Worms and Viruses: A Simulation-Based Study

Another paper in the "good worm" theory (see past papers and thoughts about this topic on wormblog at 1, 2, 3). Again, I still don't like the idea in reality, and I can understand the temptation to "fight fire with fire". However, this is a worthwhile paper to study for anyone interested in this concept.

Large-scale attacks generated by fast-spreading or stealthy malicious mobile code, such as flash worms and e-mail viruses, demand new approaches to patch management and disinfection. Currently popular centralized approaches suffer from distribution bottlenecks which cannot be solved by merely increasing the number of servers, as the number of servers required to eliminate all bottlenecks is impractically large. Recently, predators were proposed as a technique for eliminating automated mobile malware from computer networks. Predators are benevolent, self-propagating mobile programs which have the ability to clean up systems infected by malignant worms/viruses. We propose a number of extensions to the original predator model, including immunizing predators, persistent predators, and seeking predators. We report on a set of simulations which explore the effects of predators on small-scale (800 to 1600 node) networks. Our results indicate that predators hold significant promise as an alternative to the centralized patch distribution mechanism. The results show that predators can be used to disinfect systems and distribute patches rapidly across the network, without suffering from bottlenecks or causing network congestion. The results also show that the new predator models provide significant benefits over the original predator model. The simulation tool is also useful for tuning predator behavior, so that an optimal tradeoff between the peak virus/worm infection rate and the overhead generated by the predator can be chosen before a predator is released.

Source: Using Predators to Combat Worms and Viruses: A Simulation-Based Study, Ajay Gupta, Daniel C. DuVarney.

Measurement and Analysis of Worm Propagation on Internet Network Topology

Another paper on modeling infection rates on networks using an epidemic model. This is a good paper to read if you're new to the topic of modeling, since it's quite clear and direct.

There has been a constant barrage of worms over the internet during the recent past. Besides threatening network security, these worms cause an enormous economic burden in terms of loss of productivity at the victim hosts. In addition, these worms create unnecessary network data traffic that causes network congestion, thereby hurting all users. To develop appropriate tools for thwarting quick spread of worms, researchers are trying to understand the behavior of the worm propagation with the aid of epidemiological models. In this study, we apply the classical SIS model and a modification of SIR model to simulate worm propagation in two different network topologies. Whereas in the SIR model once a node is cured after infection it becomes permanently immune, our modification allows this immunity to be temporary, since the cured nodes may again become infected, maybe with a different strain of the same worm. The simulation study also shows that time to infect a large portion of the network vary significantly depending on where the infection begins. This information could be usefully employed to choose hosts for quarantine to delay worm propagation to the rest of the network.

Source: Measurement and Analysis of Worm Propagation on Internet Network Topology, Jonghyun Kim, Sridhar Radhakrishnan, Sudarshan K. Dhall.

A Behavior-Based Anti-Worm System

Another de novo worm detection system proposal ...

With the popularization of the Internet and diversification of network service, the malicious worm is one of the major damages in network security issue currently. The worm can attack a large number of computers via network in a very short period, especially distributing damage via the network services. Those worms always enter or attack computer by backdoor or under-channel. There is no effective solution to prevent from these damages caused by worms. In this paper, we proposed a behavior-based intrusion detection and response system for the Internet worm named Lambent Anti-Worm System (LAWS). The LAWS can detect the intruded services and influenced range automatically. Besides, It can also analyze the key information of the intrusion. We can keep from the worm distribution and intrusion in advanced according to detected information. In addition to detect and prevent from the distribution of well-known malicious worms, the LAWS can also defense the future, unknown, or new malicious worms. The contribution of our system is to decrease the response time of attack and reduce the damaged range. At the same time, it also diminishes the damage and decreases the fixed cost.

Source: A Behavior-Based Anti-Worm System, Jason C. Hung, Kuan-Cheng Lin, Anthony Y. Chang, Kuang Wu, Nigel H. Lin, Louis H. Lin. Presented at 17 th International Conference on Advanced Information Networking and Applications (AINA'03).

Worm Epidemics in High-Speed Networks

While not a strict academic paper, this one is interesting nonetheless.

Future worm epidemics might spread at unprecedented rates in high-speed networks. A comprehensive automated defense system will be the only way to contain new threats but could be too risky to implement without more reliable detection accuracy and better real-time traffic analysis.

Source: Worm Epidemics in High-Speed Networks,Thomas M. Chen, Jean-Marc Robert, from IEEE Computer, June, 2004.

Can we contain Internet worms? Microsoft's Project "Vigilante"

Kamal Hilmi Othman, a regular wormblog contributor, points me at a project from Microsoft featured in their recent MSR showcase TechFest. We covered this paper already when it appeared at the Hotnets III conference, but we'll update it here. Their research, dubbed the "vigilante project", seeks to provide what appears to be a host-based anomaly detection system. As Kamal points out, "it's good to see that the provider of where most worms and bots resides has taken a pretty good step in worm mitigation."

Worm containment must be automatic because worms can spread too fast for humans to respond. Recent work has proposed a network centric approach to automate worm containment: network traffic is analyzed to derive a packet classifier that blocks (or rate-limits) worm propagation. This approach has fundamental limitations because the analysis has no information about the application vulnerabilities exploited by worms. This paper proposes Vigilante, a new host centric approach for automatic worm containment that addresses these limitations. Vigilante relies on collaborative worm detection at end hosts in the Internet but does not require hosts to trust each other. Hosts detect worms by analysing attempts to infect applications and broadcast self-certifying alerts (SCAs) when they detect a worm. SCAs are automatically generated machine-verifiable proofs of vulnerability; they can be independently and inexpensively verified by any host. Hosts can use SCAs to generate filters or patches that prevent infection. We present preliminary results showing that Vigilante can effectively contain fast spreading worms that exploit unknown vulnerabilities.

Source: Can we contain Internet worms?, MSR-TR-2004-83, by Manuel Costa, Jon Crowcroft, Miguel Castro, Antony Rowstron, August 2004.

This project has caught some press attention, as you would expect:

Vigilante uses a "honey pot" architecture to trap malicious attacks and, once a network worm is detected, self-certifying alerts are generated with details on how to thwart the threat. The alerts, researchers say, eliminate the need for hosts to trust each other and enable hosts to run diverse detection engines and to spread detection load.

Source: Microsoft Shows Off Prototypes to Blunt Network Attacks, by Ryan Naraine, March 4, 2005, eWeek.

More information in these two stories:

• Microsoft has Strong Security Policy for Future, source: Technology News KNTimes.com, publish date: 3/6/2005.
• More Security and Features on Mind of Microsoft, publish date: 3/6/2005, source: Moneyplans.net.

None of the articles say when this technology, or another  project, dubbed Control-Flow Integrity, is going to be commercially available to Microsoft consumers.

Monitoring and Early Warning for Internet Worms

A paper that examines the application of the Kalman filter (see more below), which had been proposed as a means to discover trends indicative of a worm from watching network traffic.

After the Code Red incident in 2001 and the SQL Slammer in January 2003, it is clear that a simple self-propagating worm can quickly spread across the Internet, infects most vulnerable computers before people can take effective countermeasures. The fast spreading nature of worms calls for a worm monitoring and early warning system. In this paper, we propose effective algorithms for early detection of the presence of a worm and the corresponding monitoring system. Based on epidemic model and observation data from the monitoring system, by using the idea of 'detecting the trend, not the rate' of monitored illegitimated scan traffic,we propose to use a Kalman filter to detect a worm's propagation.

Source: Monitoring and Early Warning for Internet Worms , Cliff Changchun Zou, Lixin Gao, Weibo Gong, Don Towsley.

You can get more information about the Kalman filter, which is used in signal processing to disover linked input sources, at these two links: The Kalman Filter, Some tutorials, references, and research on the Kalman filter (includes a link to the original paper), and Kalman filter toolbox for Matlab.

Extortion Worms: Internet Worms that Discourage Disinfection

Another paper that covers a proposed worst-case scenario:

When thinking about clever proposed schemes for infecting the Internet with a worm in 20 minutes or 30 seconds, I started wondering what would happen next. People (I'll call them "white hats") would hurriedly figure out what software made them vulnerable, and then they'd arrange to become invulnerable to further infections and to eradicate the worm from their machines. Ideally the makers of the worm (I'll call them "black hats") would like to discourage white hats from doing this. Since the worm at this point would control a significant portion of the computational resources of the Internet, it would seem to be within reach for the worm to use its installed base to provide impressive discouragement for disinfection. This paper discusses how this might be accomplished, and how the game might play out.

Source: Extortion Worms: Internet Worms that Discourage Disinfection, Tim Freeman.

Aggregating Detectors for New Worm Identification

This caught my eye because of my involvement in the IMS project.

Internet worms have resulted in considerable disruption of our communications infrastructure and could cause much more. We propose a design for coordinating a widely distributed set of network monitors to detect the emergence of new high-speed worms, develop and validate signatures for their identification, and model their spread- ing dynamics in real time. The primary new contribution of our design is a mechanism for going from the observa- tion that there is a possible worm to automatically validat- ing that observation, developing a signature for the worm if one does not already exist, providing a predictive model for the worm's spreading, and statistically quantifying the level of confidence in these characterizations.

Source: Aggregating Detectors for New Worm Identification, Eric Anderson and Jun Li. Presented as a WIP at Usenix in 2004.

MS-SQL Slammer/Sapphire Traffic Analysis

While the SQL Slammer worm of January, 2003, has been analyzed by many, this report is a worthwhile read. Lots of data analysis.

To monitor and analyze the worm, we began capture of all UDP port 1434 traffic within a United States peering exchange at approximately 21:20 Sat Jan 25 2003 GMT (13:20 PST). Unfortunately we did not begin capture until approximately 16 hours after the first reports of the worm. However, we capture the worm in the height of its activity and also observe its behavior over time. The exchange is a mesh of switches connected by high-speed links. We monitor one direction of traffic on two different links. We do not sample, but rather capture every UDP 1434 packet. We only capture the packet headers (no payload).

Source: MS-SQL Slammer/Sapphire Traffic Analysis, Robert Beverly, MIT LCS.

An Approach for Detecting Self-Propagating Email Using Anomaly Detection

This one sort of reminds me of Feedback Email Worm Defense System for Enterprise Networks, by Cliff C. Zou, Weibo Gong, Don Towsley.

This paper develops a new approach for detecting self-propagating email viruses based on statistical anomaly detection. Our approach assumes that a key objective of an email virus attack is to eventually overwhelm mail servers and clients with a large volume of email traffic. Based on this assumption, the approach is designed to detect increases in traffic volume over what was observed during the training period. This paper describes our approach and the results of our simulation-based experiments in assessing the effectiveness of the approach in an intranet setting. Within the simulation setting, our results establish that the approach is effective in detecting attacks all of the time, with very few false alarms. In addition, attacks could be detected sufficiently early so that clean up efforts need to target only a fraction of the email clients in an intranet.

Source: An Approach for Detecting Self-Propagating Email Using Anomaly Detection, Ajay Gupta and R. Sekar.

WORM vs. WORM: Preliminary Study of an Active Counter­Attack Mechanis

Even more on the good worm strategy:

Self-propagating computer worms have been terrorizing the Internet for the last several years. With the increasing density, inter-connectivity and bandwidth of the Internet combined with security measures that inadequately scale, worms will continue to plague the Internet community. Existing anti-virus and intrusion detection systems are clearly inadequate to defend against many recent fast-spreading worms. In this paper we explore an active counter-attack method - anti-worms. We propose a method that transforms a malicious worm into an anti-worm which disinfects its original. The method is evaluated using the CodeRed, Blaster and Slammer worms. We show through simulation the effectiveness of an anti-worm with several propagation schemes and its impact on the overall network. We also discuss important limitations of the proposed method.

Source: WORM vs. WORM: Preliminary Study of an Active Counter­Attac Mechanisms, Frank Castañeda, Emre Can Sezery, Jun Xu.

Effect of Malicious Traffic on the Network

Everyone knows that large-scale attacks have a negative impact on network performance. These guys did a writeup looking at the effects of various attacks.

The Internet has witnessed a steady rise in malicious traffic including DDoS and worm attacks. In this paper, we study the effect of malicious traffic on the background traffic by analyzing recent traces from two different locations. We show that malicious traffic causes an increase in the average DNS latency by 230% and an increase in the average web latency by 30% even on highly over-provisioned links. We also study the effect of the recent linux slapper worm. Using packet-level simulations based on an empirically derived model of the worm, we demonstrate that the effect of worm-infected hosts can be disastrous when they trigger a DDoS attack.

Source: Effect of Malicious Traffic on the Network, Kun-chan Lan, Alefiya Hussain, and Debojyoti Dutta.

Early Bird: Catching worms while sysadmins sleep

Not to be confused with the Earlybird project from Savage et al., someone else is using the metaphor.

This honours thesis demonstrates the need for an automated, anomalybased Internet worm detection system that is effective at identifying Internet worm packets with a low false-positive rate.

The theory of general Discrete Symbol Hidden Markov Models and the theory of the equivalent on-line models is discussed, and the general structure of Hidden Markov Models is related to the problem of identifying Internet worm packets in a sequence of normal network packets.

The effectiveness of various on-line Hidden Markov Model configurations in detecting Sapphire Internet worm packets in a sequence of normal UDP packets is evaluated, demonstrating that Hidden Markov Models can be successfully used as the basis of an automated, anomaly-based Internet worm detection system.

Source: Early Bird: Catching worms while sysadmins sleep, Andrew Hill.

Code-Red: a case study on the spread and victims of an Internet worm

While the Code Red worm was over 3 and a half years ago (July, 2001), this is still an interesting paper.

On July 19, 2001, more than 359,000 computers connected to the Internet were infected with the Code- Red (CRv2) worm in less than 14 hours. The cost of this epidemic, including subsequent strains of Code-Red, is estimated to be in excess of $2.6 billion. Despite the global damage caused by this attack, there have been few serious attempts to characterize the spread of the worm, partly due to the challenge of collecting global information about worms. Using a technique that enables global detection of worm spread, we collected and analyzed data over a period of 45 days beginning July 2nd, 2001 to determine the characteristics of the spread of Code-Red throughout the Internet.

In this paper, we describe the methodology we use to trace the spread of Code-Red, and then describe the results of our trace analyses. We first detail the spread of the Code-Red and CodeRedII worms in terms of infection and deactivation rates. Even without being optimized for spread of infection, Code-Red infection rates peaked at over 2,000 hosts per minute. We then examine the properties of the infected host population, including geographic location, weekly and diurnal time effects, top-level domains, and ISPs. We demonstrate that the worm was an international event, infection activity exhibited time-of-day effects, and found that, although most attention focused on large corporations, the Code-Red worm primarily preyed upon home and small business users. We also qualified the effects of DHCP on measurements of infected hosts and determined that IP addresses are not an accurate measure of the spread of a worm on timescales longer than 24 hours. Finally, the experience of the Code- Red worm demonstrates that wide-spread vulnerabilities in Internet hosts can be exploited quickly and dramatically, and that techniques other than host patching are required to mitigate Internet worms.

Source: Code-Red: a case study on the spread and victims of an Internet worm, David Moore, Colleen Shannon, Jeffery Brown. There is also a PowerPoint slide deck that is related.

A Comparison Study of Three Worm Families and Their Propagation in a Network

A useful paper, though not as technical as many of the papers posted here.

Malicious code, also referred to by common terms such as viruses, worms, and trojans, are a significant component of the scope of attacks that a modern IT organization must be prepared to defend against if they are operating with any Internet connectivity at all. The general term of malicious code, an umbrella term, is used to describe any code that performs unsolicited activity without the authorization of the user, and the more common and specific terms are often seen in technical write-ups of specific instances, or in the press due to their wide spread recognition.

Source: A Comparison Study of Three Worm Families and Their Propagation in a Network, by Daniel Hanson, Bartek Kostanecki, Richard Jagodzinski, Jason V. Miller.

Trends in Viruses and Worms

An interesting bit of history of the worm problem. While short, it does point out some interesting events.

The Internet increases the vulnerability of all interconnected machines by making it easier for malicious programs to travel between computers by themselves. Recent virus and worm outbreaks, such as the Blaster worm in August 2003 and the SQL Sapphire/Slammer worm in January 2003, have demonstrated that networked computers continue to be vulnerable to new attacks despite the widespread deployment of antivirus software and firewalls. Indeed, a review of the history of viruses and worms shows that they have continually grown in sophistication over the years. This article highlights a series of significant past innovations in virus and worm technology. The purpose is to show that viruses and worms continue to pose a major risk today and most likely into the future as their creators persist in seeking ways to exploit security weaknesses in networked systems.

Source: Trends in Viruses and Worms, by Thomas M. Chen, Southern Methodist University. This article appeared in the September, 2003, issue of Cisco's IP Journal.

MS-SQL Slammer/Sapphire Traffic Analysis

Another historical analysis, this one focusing on the SQLSlammer worm from January, 2003. This analysis was not so widely shared, but proves valuable for people learning how to process traffic data.

To monitor and analyze the worm, we began capture of all UDP port 1434 traffic within a United States peering exchange at approximately 21:20 Sat Jan 25 2003 GMT (13:20 PST). Unfortunately we did not begin capture until approximately 16 hours after the first reports of the worm. However, we capture the worm in the height of its activity and also observe its behavior over time. The exchange is a mesh of switches connected by high-speed links. We monitor one direction of traffic on two different links. We do not sample, but rather capture every UDP 1434 packet. We only capture the packet headers (no payload).

Source: MS-SQL Slammer/Sapphire Traffic Analysis, Robert Beverly, MIT LCS.

Internet Quarantine: Requirements for Containing Self-Propagating Code

Quarantine is one of the hot topics going around in the worm defense world in the past year or two. Several companies have quarantine mechanisms (Arbor Networks' Peakflow X, Mazu Networks' Mazu Profiler, just to name two), as well as the government space (see the DQW project), and even academia (see the DEWP project). This is one of the key seminal papers in the space.

It has been clear since 1988 that self-propagating code can quickly spread across a network by exploiting homogeneous security vulnerabilities. However, the last few years have seen a dramatic increase in the frequency and virulence of such .worm. outbreaks. For example, the Code-Red worm epidemics of 2001 infected hundreds of thousands of Internet hosts in a very short period . incurring enormous operational expense to track down, contain, and repair each infected machine. In response to this threat, there is considerable effort focused on developing technical means for detecting and containing worm infections before they can cause such damage.

This paper does not propose a particular technology to address this problem, but instead focuses on a more basic question: How well will any such approach contain a worm epidemic on the Internet? We describe the design space of worm containment systems using three key parameters . reaction time, containment strategy and deployment scenario. Using a combination of analytic modeling and simulation, we describe how each of these design factors impacts the dynamics of a worm epidemic and, conversely, the minimum engineering requirements necessary to contain the spread of a given worm. While our analysis cannot provide definitive guidance for engineering defenses against all future threats, we demonstrate the lower bounds that any such system must exceed to be useful today. Unfortunately, our results suggest that there are significant technological and administrative gaps to be bridged before an effective defense can be provided in today.s Internet.

Source: Internet Quarantine: Requirements for Containing Self-Propagating Code, David Moore, Colleen Shannon, Geoffrey M. Voelker, Stefan Savage.

Modeling the Spread of Active Worms

This paper looks at the mathematics of worms that actively probe the network for new victims (typically via scanning). A few models are analyzed, and many equations are presented.

Active worms spread in an automated fashion and can flood the Internet in a very short time. Modeling the spread of active worms can help us understand how active worms spread, and how we can monitor and defend against the propagation of worms effectively. In this paper, we present a mathematical model, referred to as the Analytical Active Worm Propagation (AAWP) model, which characterizes the propagation of worms that employ random scanning. We compare our model with the Epidemiological model and Weaver’s simulator. Our results show that our model can characterize the spread of worms effectively. Taking the Code Red v2 worm as an example, we give a quantitative analysis for monitoring, detecting and defending against worms. Furthermore, we extend our AAWP model to understand the spread of worms that employ local subnet scanning. To the best of our knowledge, there is no model for the spread of a worm that employs the localized scanning strategy and we believe that this is the first attempt on understanding local subnet scanning quantitatively.

Source: Modeling the Spread of Active Worms, Zesheng Chen, Lixin Gao, and Kevin Kwiat.

DNS-based Detection of Scanning Worms in an Enterprise Network

An interesting paper, but it has a few assumptions that may not always hold true:

Worms are arguably the most serious security threat facing the Internet. Seeking a detection technique that is both sufficientl efficient and accurate to enable automatic containment of worm propagation at the network egress points, we propose a new technique for the rapid detection of worm propagation from an enterprise network. It relies on the correlation of Domain Name System (DNS) queries with outgoing connections from an enterprise network. Improvements over existing scanning worm detection techniques include: (1) the possibility to detect worm propagation after only a single infection attempt; (2) the capacity to detect zero-day worms; and (3) a low false positive rate. The precision of this first-mile detection technique supports the use of automated containment and suppression strategies to stop fast scanning worms before they leave the network boundary. We believe that this technique can be applied with the same precision to identify other forms of malicious behavior within an enterprise network including: mass-mailing worms, network reconnaissance activity, and covert communications. Currently, it is unclear if our DNS-based detector will work for all network protocols. In some network environments, the DNS detection technique may need to be used as a secondary input to a more sophisticated anomaly detector.

Source: DNS-based Detection of Scanning Worms in an Enterprise Network, David Whyte, Evangelos Kranakis, and P.C. van Oorschot. Presented at NDSS05.

The Internet Motion Sensor: A distributed blackhole monitoring system

Another paper from NDSS05, which just wrapped up in San Diego, California. I'm one of the authors in the paper, in which we introduce our Internet Motion Sensor architecture. We've been using this system (and its predecessor) for large scale Internet monitoring for several years now.

As national utility infrastructures become intertwined with emerging global data networks, the stability and integrity of the two have become synonymous. This connection, while necessary, leaves network assets vulnerable to the rapidly moving threats of today’s Internet, including fast moving worms, distributed denial of service attacks, and routing exploits. This paper introduces the Internet Motion Sensor (IMS), a globally scoped Internet monitoring system whose goal is to measure, characterize, and track threats. The IMS architecture is based on three novel components. First, a Distributed Monitoring Infrastructure increases visibility into global threats. Second, a Lightweight Active Responder provides enough interactivity that traffic on the same service can be differentiated independent of application semantics. Third, a Payload Signatures and Caching mechanism avoids recording duplicated payloads, reducing overhead and assisting in identifying new and unique payloads. We explore the architectural tradeoffs of this system in the context of a 3 year deployment across multiple dark address blocks ranging in size from /24s to a /8. These sensors represent a range of organizations and a diverse sample of the routable IPv4 space including nine of all routable /8 address ranges. Data gathered from these deployments is used to demonstrate the ability of the IMS to capture and characterize several important Internet threats: the Blaster worm (August 2003), the Bagle backdoor scanning efforts (March 2004), and the SCO Denial of Service attacks (December 2003).

Source: The Internet Motion Sensor: A distributed blackhole monitoring system, Evan Cooke, Michael Bailey, David Watson, Farnam Jahanian, and Jose Nazario.

12th Annual Network and Distributed System Security Symposium

The 12th Annual  Network and Distributed System Security Symposium  is going on right now in San Diego, California, and several papers are there that are of interest to Wormblog readers. Over the next few days I'll post their abstracts.

High-speed monitoring of Internet traffic is an important and challenging problem, with applications to real-time attack detection and mitigation, traffic engineering, etc. However, packet-level monitoring requires fast streaming algorithms that use very little memory space and little communication among collaborating network monitoring points.

In this paper, we consider the problem of detecting superspreaders, which are sources that connect to a large number of distinct destinations. We propose several new streaming algorithms for detecting superspreaders, and prove guarantees on their accuracy and memory requirements. We also show experimental results on real network traces. Our algorithms are substantially more efficient (both theoretically and experimentally) than previous approaches. We also provide several extensions to our algorithms - we show how to identify superspreaders in a distributed setting, with sliding windows, and when deletions are allowed in the stream.

More generally, our algorithms are applicable to any problem that can be formulated as follows: given a stream of (x, y) pairs, find all the x's that are paired with a large number of distinct y's. We call this the heavy distinct-hitters problem. There are many network security applications of this general problem. This paper discusses these and other applications, and for concreteness, focuses on the superspreader problem.

Source: New Streaming Algorithms for Fast Detection of Superspreaders, Shobha Venkataraman, Dawn Song, Phillip B. Gibbons, and Avrim Blum.

Worm and Virus Defense: How We Can Protect the Nation's Computers From These Threats Today

Liston is the author of LaBrea, a "tarpitting" mechanism to slow down scanning worms. It works by forging connection success to non-existent hosts, causing the worm system that was scanning the network to waste resources trying to send data to that host that doesn't exist.

While I agree that the implementation of these recommendations will result in increased security for our networking infrastructure, they represent long-term answers to the security issues that plague us currently. The technology exists today to slow and stop the spread of worms in an effective and inexpensive manner, needing only widespread deployment. We ignore deploying it at our infrastructure;s peril.

At the end of July of 2001, the CodeRed worm was battering networks worldwide. I sat and watched as thousands upon thousands of connections from infected machines pummeled the network that I administer. While watching this onslaught of connection attempts, I began to wonder what, if anything, could be done to stop it. In considering this, I began by studying what traits were necessary for malicious software to be 'successful,' and what could be done to use those particular traits as an advantage in network protection.

Source: Worm and Virus Defense: How We Can Protect the Nation's Computers From These Threats Today, Thomas Liston.

VIRUS ANALYSIS 1: Worm Wars

Peter Szor is one of the true giants of the AV industry. He has a new book on antivirus research, sharing his deep knowledge, coming out soon. It's listed in the sidebar here on Wormblog.

Around 1966 Robert Morris Sr., the future NSA chief scientist, decided to create a new game environment with two of his friends, Victor Vyssotsky and Dennis Ritchie. They coded it for the PDP-1 at Bell Labs, and named their game .Darwin.. Later 'Darwin'. became 'Core War', a computer game played to this day by many programmers and mathematicians as well as hackers.

The object of the game is to kill your opponents. programs by overwriting them. The original game is played between two programs written in the Redcode language, a form of assembly language. The warrior programs run in the core of a virtual machine called MARS (Memory Array Redcode Simulator). The fight between the warrior programs was referred to as Core Wars.

Well, the world used to be a better place with the fights between genies in a bottle. Who let the worms out?

Source: VIRUS ANALYSIS 1: Worm Wars Peter Ferrie, Frédéric Perriot and Péter Ször.

Intrusion Detection for Viruses and Worms

More than many other papers, this one articulates the challenges for traditional IDS for detecting and reacting to worm outbreaks.

Intrusion detection for viruses and worms must be automated because the rate of spreading can be much faster than humans can possibly react. By the time that a network administrator reacts to an alarm and analyzes IDS data to detect a worm, it may well be too late to prevent widespread infection. Recent worms such as Slammer/Sapphire or Blaster were able to spread to millions of computers within minutes. Automated intrusion detection should attempt to catch a new virus/worm outbreak as early as possible because epidemiology has shown that new outbreaks spread initially at an exponential rate. Therefore, early detection can have a critical effect on slowing down an outbreak.

Source: Intrusion Detection for Viruses and Worms, Thomas M. Chen.

Computers and Epidemiology

Worms and viruses have been at an intersection between computer networking and epidemiology for a number of years. The models are fundamentally similar, but they differ in a key way: if I'm sick, I have to make contact with a person to infect or at least travel through a similar space in a time window to pass on my germs. A computer can rapidly infect hosts around the world, randomly, in a very narrow time window, without everyone being physically close. This is a key paper to read and appreciate if you want to start thinking about worms from an epidemilogical stance.

Today, computer virus epidemiology is an emerging science that reveals that protective measures are definitely within reach of individuals and organizations. Among its findings:

• Computer viruses are far less rife than many have claimed. The rate of PC-DOS virus incidents for medium-sized to large businesses in North America appears to be about one per 1000 PCs per quarter. And fewer machines are caught up in a typical incident if anti-virus measures are in place.
• Few PC-DOS viruses have thrived. Less than 15 percent of the more than 1500 known viruses have ever been observed in a large sample population and most of them only once. The top 10 viruses account for two-thirds of all incidents.
• Because software and diskette sharing tends to be localized, even successful viruses spread at nowhere near the exponential rate that some have claimed. This is good news for the anti-virus industry, which otherwise would have to distribute its software updates even more often.
• Centralized reporting and response within an organization is an extremely effective defense. These policies have more than halved the average incident size within the population monitored by IBM Corp., and can eliminate chronic infections that may afflict even conscientious organizations.

Source: Computers and Epidemiology, Jeffrey O. Kephart, David M. Chess, Steve R. White. Published in the IEEE SPECTRUM, May 1993.

An Environment for Controlled Worm Replication and Analysis

I actually did something like this for worm detection testing and sample data while I wrote the worm book back 02 and 03. I found a number of things difficult to do with the resources I had available t ome, but this paper shows a much more mature approach to the problem.

So-called 'worms' have been a feature of the malware landscape since the beginning, and yet have been largely ignored by anti-virus companies until comparatively recently. However, the near-complete connectivity of computers in today's western world, coupled with the largely Win32-centric base of installed operating systems make the rise of worms inevitable.

The author will describe techniques and mechanisms for constructing and utilising an environment enabling the automatic examination of worms and network-aware viruses. Whilst these techniques are being developed for incorporation into the IBM/Symantec Immune System for Cyberspace, the paper is not intended to be a discussion of the Immune System concept. Instead, the intent is to describe an approach that has been applied to the problem with some measure of success.

The approach involves building a virtual SOHO network, which is in turn connected to a virtual Internet. Both the virtual LAN and WAN are populated with virtual machines. The suspected worm is introduced into this environment, and executed therein. The whole system is closely monitored as execution progresses in the isolated environment, and data is amassed describing what the suspected worm did as it executed. This data is then processed by the system in an attempt to automatically determine whether or not the suspect programming is performing actions indicative of a worm or internet-aware malware.

Source: An Environment for Controlled Worm Replication and Analysis or: Internet-inna-Box, Ian Whalley Bill Arnold, David Chess, John Morar, Alla Segal, Morton Swimmer.

It turns out that one of the major problems in such an approach is ensuring that a worm host can quickly encounter another vulnerable system in a reasonable amount of time. You may have to play with routing, condense and reverse NAT hosts (ie whole /8 networks to a single host or virtual host), or modify the worm code. This is a tricky act, but it's vital to understand why your worm isn't propagating in your virtual host environment.

Biological Models of Security for Virus Propagation in Computer Networks

Continuing on in the recent thread on biologically inspired worm defenses, a recent overview paper from Sanjay Goel and Stephen F. Bush.

This article discusses the similarity between the propagation of pathogens (viruses and worms) on computer networks and the proliferation of pathogens in cellular organisms (organisms with genetic material contained within a membraneencased nucleus). It introduces several biological mechanisms which are used in these organisms to protect against such pathogens and presents security models for networked computers inspired by several biological paradigms, including genomics (RNA interference), proteomics (pathway mapping), and physiology (immune system). In addition, the study of epidemiological models for disease control can inspire methods for controlling the spread of pathogens across multiple nodes of a network. It also presents results based on the authors' research in immune system modeling.

Source: biological models of security for virus propagation in computer networks, Sanjay Goel and Stephen F. Bush. This paper appeared in Usenix Login Magazine, December, 2004. For people who don't have a Usenix membership (and therefore can't download the PDF), you can grab a copy of the paper from this alternate site. This paper was pointed out to me by Kamal Hilmi Othman. 

The EarlyBird System for Real-time Detection of Unknown Worms

Now this is the one I meant to refer to earlier. I knew that Savage and company had done a project called "EarlyBird".

Network worms are a major threat to the security of today's Internet-connected hosts and networks. The combination of unmitigated connectivity and widespread software homogeneity allows worms to exploit tremendous parallelism in propagation. Modern worms spread so quickly that no human-mediated reaction to the outbreak of a new worm can hope to prevent a widespread epidemic. In this paper we propose an automated method for detecting new worms based on traffic characteristics common to most of them: highly repetitive packet content, an increasing population of sources generating infections and an increasing number of destinations being targeted. Our method generates content signatures for the worm without any human intervention. Preliminary results on a small network show promising results: we have identified three confirmed worms with a low percentage of false positives. This gives us reason to believe that our method could form the core of an effective network-level worm detection and countermeasure system capable of substantially slowing down the spread of new worms.

Source: The EarlyBird System for Real-time Detection of Unknown Worms,  Sumeet Singh, Cristian Estan, George Varghese and Stefan Savage.

Learning to Detect New and Unknown Malicious Programs

As you may have guessed by now, the automated discovery of new threats for rapid response is one of my favorite topics. This paper is up that alley:

Malicious programs pose a major threat to security, especially in the Windows platform. The most dangerous of these malicious programs are the ones that are new or unknown because they are not detected by traditional signature based anti-virii software. In this paper we present a data-mining approach to detecting new and unknown malicious programs. We extract a set of features from these programs through static analysis and build a classifier that detects which programs are potentially malicious. This classifier can generalize to other new or other unknown programs. We verify our results by testing our methods on a set of programs not used during training (i.e., programs unknown to our classifier). In one experiment, our method detects 81.54% of previously unknown malicious programs with a 0.96% false-positive rate.

Source: Learning to Detect New and Unknown Malicious Programs, Eleazar Eskin, Matthew G. Schultz, Erez Zadok, and Salvatore J. Stolfo.

MINDS - Minnesota Intrusion Detection System

Another paper on traditional IDS technologies and how they can be used to detect worm activity.

This paper introduces the Minnesota Intrusion Detection System (MINDS), which uses a suite of data mining techniques to automatically detect attacks against computer networks and systems. While the long-term objective of MINDS is to address all aspects of intrusion detection, this paper focuses on two specific contributions: (i) an unsupervised anomaly detection technique that assigns a score to each network connection that reflects how anomalous the connection is, and (ii) an association pattern analysis based module that summarizes those network connections that are ranked highly anomalous by the anomaly detection module. Experimental results on live network traffic at the University of Minnesota show that our anomaly detection techniques are very promising and are successful in automatically detecting several novel intrusions that could not be identified using popular signature-based tools such as SNORT. Furthermore, given the very high volume of connections observed per unit time, association pattern based summarization of novel attacks is quite useful in enabling a security analyst to understand and characterize emerging threats.

Source: MINDS - Minnesota Intrusion Detection System, Levent Ertöz, Eric Eilertson, Aleksandar Lazarevic, Pang-Ning Tan, Vipin Kumar, Jaideep Srivastava, Paul Dokas.

This paper covers how they used MINDS to detect various worm instances on a large network. What is interesting is how they did it, basically using behavioral based approaches to monitor the in- and out-degree of network nodes. When the out-degree surges higher than expected, it's often a sign of an infected host attempting to propagate to other hosts. All scanned hosts will have their in-degree values rise in this scenario.

Anatomy of a Commercial-Grade Immune System

Another installment looking at biologically inspired AV and worm tools.

We have built the first commercial-grade immune system that can find, analyze and cure previously unknown viruses faster than the viruses themselves can spread. The system solves several important problems. A single console allows a customer administrator to decide whether viruses are submitted for analysis automatically, or whether explicit approval is required, and permits new virus definitions to be distributed automatically in response to a new virus, or held for the administrator's approval. A novel active network architecture permits the system to handle a vast number of customer submissions quickly, so the system can handle floods due to an epidemic of a fast-spreading virus, or due to submission of many uninfected files. The analysis center can analyze most viruses automatically, and with greater speed and precision than human analysts can. The analysis center runs the viruses in a virtual environment, so the process is safe and lets our programs analyze the behavior of the virus in real time. Viruses can be replicated in a number of operating system and application environments, including various national languages. Upconversion and downconversion of macro viruses are handled automatically. Both the active network and the analysis center are scaleable, so the system can easily accommodate ever-increasing loads. End-to-end security of the system allows the safe submission of virus samples and ensures authentication of new virus definitions. During the presentation, we will give a live demonstration of a pilot that we have run with customers, and review our experience with the pilot system.

Source: Anatomy of a Commercial-Grade Immune System, Steve R. White, Morton Swimmer, Edward J. Pring, William C. Arnold, David M. Chess, John F. Morar.

This is the final installment of the series of papers and resources on biologically inspired worm defenses. Many of these themes appear in other papers posted here, often using terms like "anomaly detection" and trend analysis. They are roughly the same as a biologically inspired defense, namely detecting deviations from normalcy or "homeostasis", although they utilize different methods to detect what is the root cause of the problem.

A Biologically Inspired Immune System for Computers

A second paper similar to yesterday's original blueprint paper:

Computer viruses are the first and only form of artificial life to have had a measurable impact on society. Currently, they are a relatively manageable nuisance. However, two alarming trends are likely to make computer viruses a much greater threat. First, the rate at which new viruses are being written is high, and accelerating. Second, the trend towards increasing interconnectivity and interoperability among computers will enable computer viruses and worms to spread much more rapidly than they do today.

To address these problems, we have designed an immune system for computers and computer networks that takes much of its inspiration from nature. Like the vertebrate immune system, our system develops antibodies to previously unencountered computer viruses or worms and remembers them so as to recognize and respond to them more quickly in the future. We are careful to minimize the risk of an auto-immune response, in which the immune system mistakenly identifies legitimate software as being undesirable. We also employ nature's technique of fighting self-replication with self-replication, which our theoretical studies have shown to be highly effective.

Many components of the proposed immune system are already being used to automate computer virus analysis in our laboratory, and we anticipate that this technology will gradually be incorporated into IBM's commercial anti-virus product during the next year or two.

Source: A Biologically Inspired Immune System for Computers, Jeffrey O. Kephart Published in Artificial Life IV, Proceedings of the Fourth International Workshop on Synthesis and Simulatoin of Living Systems, Rodney A. Brooks and Pattie Maes, eds., MIT Press, Cambridge, Massachusetts, 1994, pp. 130-139.

IBM kept referring to a forthcoming AV product using this research, although they appear to have stopped development of that (in fact almost all of their AV research) many years ago.

Blueprint for a Computer Immune System

An older paper from IBM, but one in a series in which they developed a biologically inspired network immune system:

There is legitimate concern that, within the next few years, the Internet will provide a fertile medium for new breeds of computer viruses capable of spreading orders of magnitude faster than today's viruses. To counter this threat, we have developed an immune system for computers that senses the presence of a previously unknown pathogen, and within minutes automatically derives and deploys a prescription for detecting and removing it. The system is being integrated with a commercial anti-virus product, IBM AntiVirus, and will be available as a pilot in 1997.

Source: Blueprint for a Computer Immune System, Jeffrey O. Kephart, Gregory B. Sorkin, Morton Swimmer, and Steve R. White This paper was originally presented at the Virus Bulletin International Conference in San Francisco, California, October 1-3, 1997.

In the next few days I'll be posting some follow ups to this paper.

Biologically Inspired Worm Defenses

I am going to post several papers and links in the next few days on a topic that is near and dear to me, namely biologically inspired worm defenses. My original field of work was in the life sciences, and I'm always pleased to see people applying useful approaches across disciplines.

From Carleton University, a Winter 2004 course entitled COMP 5900V: Biological Approaches to Computer Security. From the course description:

Course on the applicability of biological metaphors to computer security. Computer immunology, autonomic computing, and computer homeostasis are compared with traditional approaches to authentication, integrity, and intrusion detection. Relevant background biology will be presented. Students will design and critique new security mechanisms.

Source: COMP 5900V: Biological Approaches to Computer Security, Carleton University, Winter 2004.

While it looks like this course is largely over, it does contain a great number of links and matrial applicable to developing and thinking about new approaches to network security as a defense against Internet-based worms.

The Monitoring and Early Detection of Internet Worms

As always, another well written and thorough paper from Zou and colleagues.

After many Internet-scale worm incidents in recent years, it is clear that a simple self-propagating worm can quickly spread across the Internet and cause severe damage to our society. Facing this great security threat, we need to build an early detection system that can detect the presence of a worm in the Internet as quickly as possible in order to give people accurate early warning information and possible reaction time for counteractions. This paper first presents an Internet worm monitoring system. Then, based on the idea of .detecting the trend, not the burst. of monitored illegitimate traffic, we present a .trend detection. methodology to detect a worm at its early propagation stage by using Kalman filter estimation, which is robust to background noise in the monitored data. In addition, for uniform-scan worms such as Code Red, we can effectively predict the overall vulnerable population size, and estimate accurately how many computers are really infected in the global Internet based on the biased monitored data. For monitoring a nonuniform scan worm, especially a sequential-scan worm such as Blaster, we show that it is crucial for the address space covered by the worm monitoring system to be as distributed as possible.

Source: The Monitoring and Early Detection of Internet Worms, Cliff C. Zou, Weibo Gong, Don Towsley, and Lixin Gao.

This paper is highly recommended, if only for the well described mathematics, but it is also a great application of distributed systems, trend analysis and the Kalman filter approach.

The Routing Worm

Most well-known Internet worms, such as Code Red, Slammer, and Blaster, infected vulnerable computers by scanning the entire Internet IPv4 space. In this paper, we present a new scan-based worm called "routing worm", which can use information provided by BGP routing tables to reduce its scanning space without ignoring any potential vulnerable computer. In this way, a routing worm can propagate twice to more than three times faster than a traditional worm. In addition, the geographic information of allocated IP addresses, especially BGP routing prefixes, enables a routing worm to conduct fine-grained selective attacks: hackers or terrorists can selectively impose heavy damage to vulnerable computers in a specific country, an Internet Service Provider, or an Autonomous System, without much collateral damage done to others. Routing worms can be easily implemented by attackers and they could cause considerable damage to our Internet. Since routing worms are scan-based worms, we believe that an effective way to defend against them and all other scan-based worms is to upgrade IPv4 to IPv6 . the vast address space of IPv6 ( 264 IP addresses for a single subnetwork) can prevent a worm from spreading through scanning.

Source: Routing Worm: A Fast, Selective Attack Worm based on IP Address Information, Cliff C. Zou, Don Towsley, Weibo Gong, and Songlin Cai.

Unlike many worst case analyses, this one actually performs some analysis and is a worthwhile read. What typically bothers me about "worst case worms" is that they are based on conjecture, untested proposals, and untenable assumptions (ie infinite bandwidth, complete knowledge of the topology). This paper doesn't suffer greatly from these problems, and is better for it's efforts to test the conjecture.

Network Detection of Worms and Viruses

From Peter J. Welcher and Carole Warner Reece, an overview of worm detection techniques from various data sources:

Here's the short list of network methods for detecting a worm or virus attack. The assumption is that the worm is actively trying to propagate itself to other machines. There are other similar methods not on the list; once you've gotten the idea, you can invent your own variations on this theme.

   
• NBAR discovery    
• RMON2 at L7 with RMON probe or NAM    
• NetFlow (show commands or w/a NetFlow collection/reporting system)    
• Switch MLS statistics    
• ACL or VACL    
• Sinkhole router    
• Packet analyzer software    
• Host firewalls    
• IDS or PIX reporting (CW V/SMS Monitoring for Security; SIMS)

Source; Network Detection of Worms and Viruses, by Peter J. Welcher and Carole Warner Reece in the December 2003 issue of Enterprise Networks & Servers.

The article provides a decent set of links and pointers to information on worm detection. While not technical (like many of the papers posted here), it is a decent overview of some of the methods that people are using to detect and stop worm outbreaks. This piece focuses on practical and successful techniques.

Designing a Framework for Active Worm Detection on Global Networks

Another paper from Berk, Bakos and Morris on worm detection. Previously we posted about their detection system using ICMP messages.

Internet worms have caused widespread damage. Knowing the connection characteristics of such a worm very early in its proliferation cycle might provide first responders an opportunity to intercept a global scale epidemic.

We are presenting a scalable framework for detecting, in near-realtime, active Internet worms on global networks, both public and private. By aggregating network error messages resulting from failed attempts at packet delivery, we are able to infer deviant connection behavior of hosts on interconnected networks. The Internet Control Message Protocol (ICMP) provides such error notification. Using a potentially unlimited number of collectors and analyzers, we identify 'blooms' of activity. The connection characteristics of these 'blooms' are then correlated to identify worm-like behavior, and an alert is raised.

Promising results have been produced with a simulated Internet worm, demonstrating that new worms can be detected within the first few minutes after release, depending on the level of participating router coverage.

Source: Designing a Framework for Active Worm Detection on Global Networks, Vincent Berk, George Bakos, and Robert Morris.

Like their previous work, this one appears to have a solid foundation and contributes to the body of novel worm detection mechanisms. Like other new worm detection techniques, this one attempts to use a set of changes in the network that are constantly observed during worm outbreaks, in this case failed host connection attempts. Because it uses ICMP messages from he router, the detectors can be relatively stateless per connection attempt (but keep statistics on the quantity of ICMP messages seen and the rate of their generation). One caveat, though, is ICMP message throttling by some TCP/IP stacks (to prevent congestion attacks). This would reduce the number of messages seen and slow down the rate of worm detection. Under some conditions (ie high quantities of background scanning, where ICMP unreachable messages would be frequently generated), these scenarios would be frequently encountered.

Shield: vulnerability-driven network filters for preventing known vulnerability exploits

Another paper that examines the utility of patching in the face of a fast moving threat like a worm:

Software patching has not been effective as a first-line defense against large-scale worm attacks, even when patches have long been available for their corresponding vulnerabilities. Generally, people have been reluctant to patch their systems immediately, because patches are perceived to be unreliable and disruptive to apply. To address this problem, we propose a first-line worm defense in the network stack, using shields -- vulnerability-specific, exploit-generic network filters installed in end systems once a vulnerability is discovered, but before a patch is applied. These filters examine the incoming or outgoing traffic of vulnerable applications, and correct traffic that exploits vulnerabilities. Shields are less disruptive to install and uninstall, easier to test for bad side effects, and hence more reliable than traditional software patches. Further, shields are resilient to polymorphic or metamorphic variations of exploits.In this paper, we show that this concept is feasible by describing a prototype Shield framework implementation that filters traffic above the transport layer. We have designed a safe and restrictive language to describe vulnerabilities as partial state machines of the vulnerable application. The expressiveness of the language has been verified by encoding the signatures of several known vulnerabilites. Our evaluation provides evidence of Shield's low false positive rate and small impact on application throughput. An examination of a sample set of known vulnerabilities suggests that Shield could be used to prevent exploitation of a substantial fraction of the most dangerous ones.

Source: Shield: vulnerability-driven network filters for preventing known vulnerability exploits, in ACM SIGCOMM Computer Communication Review, Volume 34 ,  Issue 4  (October 2004), Helen J. Wang, Chuanxiong Guo, Daniel R. Simon, and Alf Zugenmaier.

Having looked at the complexity of the problem when patches are introduced, I agree with the authors and don't like patches applied under duress. While i don't disagree that patching can make a difference, patching introduces software interruptions and downtime. However, given the complex nature of software to already vulnerable to malformed input, I worry that some software will still break (ie leading to downtime and loss of availability) with this rewritten traffic. I wonder if this approach is the best thing to take during a worm outbreak, but it sounds more realistic than patching or trying to fix all bugs. I agree that it has merit and warrants a reasonable investigation.

Detecting Unknown Massive Mailing Viruses Using Proactive Methods

From the University of Texas, a paper that appeared at RAID 04 on detecting mass mailer worms:

The detection of unknown viruses is beyond the capability of many existing virus detection approaches. In this paper, we show how proactive customization of system behaviors can be used to improve the detection rate of unknown malicious executables. Two general proactive methods, behavior skewing and cordoning, and their application in BESIDES, a prototype system that detects unknown massive mailing viruses, are presented.

Source: Recent Advances in Intrusion Detection: 7th International Symposium, RAID 2004, Sophia Antipolis, France, September 15 - 17, 2004. Proceedings, "Detecting Unknown Massive Mailing Viruses Using Proactive Methods", Ruiqi Hu1  and Aloysius K. Mok. Also see the preprint from the University of Texas website.

This is quite interesting, and a quick review of the approach reveals that it appears to be a valid approach. I wonder if anyone wil pick this up and implement it for other mail server software systems. Because mail delivery is relativel centralized (as are many application layer networks), it makes sense to detect and defend at these points. Given enough observations, detecting emerging threats is possible.

Polymorphic Worms

Are network detection tools that are based on static, known signatures destined to fail completely against worms in the future (and not just be delayed when compared to the timeline of the worm's release)?

Normal traffic can provide worms with a very good source of information to camouflage themselves. In this paper, we explore the concept of polymorphic worms that mutate based on normal traffic. We assume that a worm has already penetrated a system and is trying to hide its presence and propagation attempts from an IDS.We focus on stealthy worms that cannot be reliably detected by increases in traffic because of their low propagation factor.We first give an example of a simple polymorphic worm. Such worms can evade a signature-based IDS but not necessarily an anomaly-based IDS. We then show that it is feasible for an advanced polymorphic worm to gather a normal traffic profile and use it to evade an anomaly-based IDS.We tested the advanced worm implementation with three anomaly IDS approaches: NETAD, PAYL and Service-specific IDS. None of the three IDS approaches were able to detect the worm reliably. We found that the mutated worm can also evade other detection methods, such as the Abstract Payload Execution.

The goal of this paper is to advance the science of IDS by analyzing techniques polymorphic worms can use to hide themselves. While future work is needed to present a complete solution, our analysis can be used in designing possible defenses. By showing that polymorphic worms are a practical threat, we hope to stimulate further research to improve existing IDS.

Source: Advanced Polymorphic Worms: Evading IDS by Blending in with Normal Traffic, Oleg Kolesnikov andWenke Lee (via Citeseer).

Interested readers will want to also make sure that theyr'e familiar with Ptacek and Newsham's seminal work Insertion, Evasion, and Denial of Service, the paper that still inspires ways of defeating IDS engines. Furthermore, people will want to see tools like ADMmutate, which lets you write polymorphic shellcode using techniques that can be described as algabraic equivilencies. This has been said for several years now, once worm authors start doing this we're hosed. However, this can already happen with worms that abuse  services over encrypted sockets (ie SSL-based flaws).

Automated Worm Fingerprinting

This paper is very much like another EarlyBird paper posted here recently:

Network worms are a clear and growing threat to the security of today's Internet-connected hosts and networks. The combination of the Internet's unrestricted connectivity and widespread software homogeneity allows network pathogens to exploit tremendous parallelism in their propagation. In fact, modern worms can spread so quickly, and so widely, that no human-mediated reaction can hope to contain an outbreak.

In this paper, we propose an automated approach for quickly detecting previously unknown worms and viruses based on two key behavioral characteristics-a common exploit sequence together with a range of unique sources generating infections and destinations being targeted. More importantly, our approach-called "content sifting"-automatically generates precise signatures that can then be used to filter or moderate the spread of the worm elsewhere in the network.

Using a combination of existing and novel algorithms we have developed a scalable content sifting implementation with low memory and CPU requirements. Over months of active use at UCSD, our Earlybird prototype system has automatically detected and generated signatures for all pathogens known to be active on our network as well as for several new worms and viruses which were unknown at the time our system identified them. Our initial experience suggests that, for a wide range of network pathogens, it may be practical to construct fully automated defenses-even against so-called "zero-day" epidemics.

Source: Automated Worm Fingerprinting, Sumeet Singh, Cristian Estan, George Varghese, and Stefan Savage, appeared at OSDI 2004.

Quickly scanning this paper reveals some interesting algorithms and approaches. I'm concerned a bit about the algorithm described in Figure 1, however. It uses simple thresholds to detect the presence of multiple targets. However, this seems like it would be indistinguishable from P2P traffic, for example, or any sort of related activity which sees increasing interest. Some initial analysis must be done on the payloads prior to analyzing them in this fashion or a high number of false positives are likely to be thrown for P2P requests. Furthermore, it seems important to periodically flush out the list of buffers, providing a sliding window of observations. Over time, these thresholds will be hit as observations accumulate. And finally, it's important to keep a baseline of observations of payloads to avoid detecting normal traffic changes as new worms.

Otherwise this is a worthwhile paper and it seems to have proven itself in field testing.

Worm Detection, Early Warning and Response Based on Local Victim Information

Worm detection systems have traditionally focused on global strategies and required a large network, say 2²⁰ nodes. The value of this approach is clear; however, worm detection techniques for smaller local networks have not been fully explored. In the absence of a global worm detection system, we examine the effectiveness of local worm detection and response strategies.

This paper makes three contributions: (1) We propose a simple two-phase local worm victim detection algorithm, DSC (Destination-Source Correlation), based on worm behavior in terms of both infection pattern and scanning pattern. DSC can detect zero-day scanning worms with a high detection rate and very low false positive rate. (2) We demonstrate the effectiveness of early worm warning based on local victim information. For example, warning occurs with 0.19\% infection of all vulnerable hosts on Internet when using a /12 monitored network. (3) Based on local victim information, we investigate and evaluate the effectiveness of an automatic real-time local response in terms of slowing down the global Internet worms propagation. (2) and (3) are general results, not specific to certain detection algorithm like DSC. We demonstrate (2) and (3) with both analytical models and packet-level network simulator experiments.

Source: Worm Detection, Early Warning and Response Based on Local Victim Information (PDF here), Guofei Gu, Monirul Sharif, Xinzhou Qin, David Dagon, Wenke Lee, and George Riley. To appear at the 20th Annual Computer Security Applications Conference.

These authors have been listed here before for their HoneyStat tool. The DSC algorithm described in this paper is worth studying and evaluating. It's much like a technique I developed, although they are not completely identical. As you may have guessed, I'm partial to things like naive detection systems (which can detect new and emerging threats) and behavioral characterization of the threat as opposed to specific attributes.

In this paper, a few potentially problematic spots creep up. The first is the percetage of the network that must be infected for the worm to be detected. The authors found a 0.19% infection percentage required to trigger an alert. Under all but the least aggressive worms which wont infect hunreds of thousands of machines, this percentage is still a large number of systems. Secondly, the DSC algorithm requires that the worm be propagating for it to be detected. The system looks for both sources and destinations growing over time. Thirdly, the rate of spread needs to be sufficiently fast for the algorithm to trigger an alert based on the rate of change of the obsrvations. Finally, if the worm uses multiple vectors to probe hosts and doesn't try any one of them too frequently (ie a round robin infection method attempt), the observations will lag behind the worm's spread. These limitations are also noted by the authors: "Clearly, DSC does not aim to detect all types of worms. It is unlikely any one algorithm could detect all manner of malware. Instead, DSC aims to detect scan-based, fast spreading worms. Further, we presume that the infection time for hosts is not very long. In other words, DSC may not effectively detect email worms, very slow scanning worm, or sleeper worms with very slow rates of infection." With these caveats in mind, the premise of DSC, and the finding published by the authors, are interesting and show promise against a major class of worms.

Worm Origin Identification Using Random Walks

We propose a novel technique for determining the origin of a quickly propagating worm or the worm’s entry point to an intranet, for law enforcement or diagnostic purposes. Our technique rests upon an architecture in which network routers or end hosts record flow records and make them available for querying. Querying these records, our search then walks backward randomly along paths of flows. Due to the “wide tree” shape of a worm propagation emanating from the source, those edges near the top of the tree emerge as edges more frequently traversed in random walks, thereby aiding in identifying the source. We detail the effectiveness of this approach using both analysis and simulation, and argue the feasibility of the architecture needed to implement it.

Source: Worm Origin Identification Using Random Walks, Yinglian Xie Vyas Sekar, David A. Maltz, Michael K. Reiter, and Hui Zhang.

An interesting paper, and one of the more interesting methods I've seen in a long time for worm host detetcion.

Active Worm Detection using ICMP Messages

Another paper on detecting worms using ICMP messages, from the same authors:

Internet worms have caused widespread damage. Knowing the connection characteristics of such a worm very early in its proliferation cycle might provide first responders an opportunity to intercept a global scale epidemic.

We are presenting a scalable framework for detecting, in near-realtime, active Internet worms on global networks, both public and private. By aggregating network error messages resulting from failed attempts at packet delivery, we are able to infer deviant connection behavior of hosts on interconnected networks. The Internet Control Message Protocol (ICMP) provides such error notification. Using a potentially unlimited number of collectors and analyzers, we identify 'blooms' of activity. The connection characteristics of these 'blooms' are then correlated to identify worm-like behavior, and an alert is raised.

Promising results have been produced with a simulated Internet worm, demonstrating that new worms can be detected within the first few minutes after release, depending on the level of participating router coverage.

Source: Designing a Framework for Active Worm Detection on Global Networks, Vincent Berk, George Bakos, Robert Morris.

Berk and Bakos also developed the worm detection using ICMP messages paper posted here in November. A similar paper, and also an interesting system for a large class of worms.

Plant Epidemiological Methods To Track Computer Network Worms

From Rishikesh Pande, a Master's thesis that I take notice of. He gets into some modelling I find interesting, correlation analysis, and applies techniques from other sciences to the problem of worm detection:

Network worms that scan random computers have caused billions of dollars in damage to enterprises across the Internet. Earlier research has concentrated on using epidemiological models to predict the number of computers a worm will infect and how long it takes to do so. In this research, one possible approach is outlined for predicting the spatial flow of a worm within the local area network (LAN).

The approach in this research is based on the application of mathematical models and variables inherent in plant epidemiology. In particular, spatial autocorrelation has been identified as a candidate variable that helps predict the spread of a worm over a LAN. This research describes the application of spatial autocorrelation to the geography and topology of the LAN and describes the methods used to determine spatial autocorrelation. Also discussed is the data collection process and methods used to extract pertinent information. Data collection and analyses are applied to the spread of three historical network worms on the Virginia Tech campus and the results are described.

Spatial autocorrelation exists in the spread of network worms across the Virginia Tech campus when the geographic aspect is considered. If a new network worm were to start spreading across Virginia Tech.s campus, spatial autocorrelation would facilitate tracking the geographical locations of the spread. In addition if an infection with a known value of spatial autocorrelation is detected, the characteristics of the worm can be identified without a complete analysis.

Source: Using Plant Epidemiological Methods To Track Computer Network Worms, Rishikesh Pande, Master's Thesis.

What's great about this format, also, is that there is plenty of room for code, meaning you can examine the implementation and learn from it. Give it a whirl, this is a great thesis.

Earlybird: Catching the Internet Worm

From UC Berkeley, an interesting project that focuses on worm detection:

Internet worms, or malicious programs that spread autonomously from computer to computer, have become a problem at the forefront of computer security concerns in recent years. Several different approaches to the problem provide partial solutions, but the general problem of detecting when a worm has entered a network has not been solved. In this paper, we apply machine learning techniques to the problem of worm detection.

We apply the tools of graphical models and statistical inference to the problem of detecting internet worms. Specifically, we model the problem as an HMM, in which the hidden state is either packet in- fected or packet clean, and the learner make observations on internet traffic. We survey current problems and solutions in the field of internet worm defense. We discuss approaches to modeling the problems, and we touch on several issues in representation and simulation. We describe models for normal network behavior and worm behavior that enable large-scale simulation of normal networks and worm infection, and we discuss simplifications and tradeoffs that aid in performing such simulation.

Finally, we discuss our experience with implementing a simulator and our frustrations due to persistent bugs. We analyze the (incomplete) results we have obtained, and we show that the simulator and learner do produce interesting behavior that shows evidence of learning potential once the bugs are eliminated.

Source: Earlybird: Catching the Internet Worm, Marco Barreno, Final project: CS 281A, December 2003.

While the paper is somewhat lacking in implementation details, the approach itself looks somewhat promising, looking at common traits of worm infected hosts and how you might detect them.

Deworming the Internet from a Legal Perspective

Forwarded from Dan Ellis, a very long but worthwhile paper on fixing the worm problem from someone outside the field:

Both law enforcement and markets for software standards have failed to solve the problem of software that is vulnerable to infection by network-transmitted worms. Consequently, regulatory attention should turn to the publishers of worm-vulnerable software. Although ordinary tort liability for software publishers may seem attractive, it would interact in unpredictable ways with the winner-take-all nature of competition among publishers of mass-market, internet-connected software. More tailored solutions are called for, including mandatory bug bounties for those who find potential vulnerabilities in software, minimum quality standards for software, and, once the underlying market failure is remedied, liability for end users who persist in using worm-vulnerable software.

Source: Deworming the Internet, Douglas Barnes, published in Texas Law Review Volume 83, Issue No. 1.

I simply can't see how this can posibly work all that well. While it's true that worms add some pressure to the Internet as a whole to clean up security problems, that need really hasn't been created in recent years. It's getting worse as more malware comes alive and is released, and it's also getting worse as more consumers begin using the Internet. However, I don't see any regulations as being capable of stopping it.

The Internet is a dramatic shift in communications technology when compared to media forms like the phone network, where access is controlled both by physical access to open access points (aside from your phone) and by the circuit switching and routing infrastructure, and also communications media like radio, newspapers and television. Just as the invention of the press revolutionized print media and was dramatically redone with desktop publishing, the Internet has forever changed how we communicate by fundamentally democratizing network access. Desktop publishing allowed for anyone with anything to say get their material printed in a professional looking manner, opening the door to thousands of new voices, some of which are reasonable and some of which are objectionable by many. The Internet is similar in that new software and contacts can be both beneficial and objectionable. This isn't equating code with speech, but it is drawing a parallel to the effects of opening up access to arbitrary people. Some will do good and some will do harm, you can't prevent it.

Furthermore, penalizing people for having a computer that is worm infected is short sighted. The knowledge required to recognize the problem and know what to do about it is beyond the scope of almost all computer users. When they notice something is wrong it's usually, "The Internet is slow". The cause is malware congesting their network link or CPU cycles. Almost no one who uses a computer can determine what's wrong, which means that it's unreasonable for them to react to it in a responsible manner, or to know what sane precautions are. Compared to the automobile and other potentially risky devices and activities, computers are still in their infancy with respect to our relationship with them.

Finally, you can't regulate away software flaws or their discovery. If anything, the security community's adoption of open communication with vendors came about because of the original open disclosure policies, which forced the reluctant hand of vendors. This relationship can't be stopped, it's done more benefit than harm overall. Software construction is still an engineering discipline in its infancy, and we're all learning what works and what doesn't. And it's very complex, and unlike physical constructions it's not always appearant what to test. We can't regulate it like we would civil or structural engineering.

This isn't to say that we can't do better or that we are blameless, but I fail to see how regulation and tort law can be of any help here at this stage. But you should read the paper anyhow for a very well written argument, even if I disagree with it. Who knows, you may find it a reasonable position to take.

Internet Worm Detection as part of a Distributed Network Inspection System

From Eamonn Linehan's Master's thesis on worm detection:

The most widely publicized, and arguably most damaging, types of malicious traffic on the Internet today include worms, spam, viruses and denial of service attacks. Internet worms self propagate across networks exploiting flaws in operating systems and services, spreading viruses and congesting network links. Worms constitute a significant security and performance threat and have recently been used to facilitate distributed denial of service (dDoS) attacks. It is the aim of this dissertation to investigate approaches for detecting a wide range of malicious activity such as worms and (d)DoS. This dissertation describes the design and implementation of an object orientated framework for distributed intrusion detection. The framework features heterogeneous sensors with a configurable event source that can adapt by dynamically composing components at run-time. The sensors are controlled remotely by a management application that can configure, extend and control sensors individually. The framework is extensible and allows researchers to quickly implement and evaluated detection techniques in a live network environment. A number of components have been implemented for the framework including a component designed to detect internet worms. It was found that this component could successfully detect a range of malicious activity including worms on both low utilisation dial-up links and gateway router links.

Source: Internet Worm Detection as part of a Distributed Network Inspection System, Eamonn Linehan, MSc thesis, University of Dublin, 2004.

Like most good theses, this one has a great background and set of references. Unlike many theses, no code is given in this version of the thesis, although modules and methodologies are explained. In reviewing this work, this appears to be an interesting and promising approach to separating signals from noise in complex, dynamic environments.

Countering Worms with Patches

While patch management as a worm solution isn't anything new, here's an interesting academic study of the approach which concludes it's a viable solution.

The ability of worms to spread at rates that effectively preclude human-directed reaction has elevated them to a first-class security threat to distributed systems. We propose an architecture for automatically repairing software flaws that are exploited by network worms. Our approach relies on source code transformations to quickly apply automatically-created (and tested) localized patches to vulnerable segments of the targeted application. To determine these susceptible portions, we use a sandboxed instance of the application as a “clean room” laboratory that runs in parallel with the production system and exploit the fact that a worm must reveal its infection vector to achieve its goal (i.e., further infection). We believe our approach to be the first end-point solution to the problem of malicious self-replicating code. The primary benefits of our approach are (a) its low impact on application performance, (b) its ability to respond to attacks without human intervention, and (c) its capacity to deal with “zero-day” worms (for which no known patches exist). Furthermore, our approach does not depend on a centralized update repository, which can be the target of a concerted attack similar to the Blaster worm. Finally, our approach can also be used to protect against lower intensity attacks, such as intrusion (“hack-in”) attempts. To experimentally evaluate the efficacy of our approach, we use our prototype implementation to test a number of applications with known vulnerabilities. Our preliminary results indicate a success rate of 82%, and a maximum repair time of 8.5 seconds.

Source: Countering Network Worms Through Automatic Patch Generation, S. Sidiroglou and A. Keromytis.

This is part of the Network Security Lab effort to provide a worm vaccine architecture aimed at giving networks survivability during a worm attack. One of the key problems with this is rapidly understanding the flaw the worm is exploiting and determining that the patch provides immunity against the attack. The second concern is centered around the disruptiveness of patching on normal business operations. Software often depends on flaws or features that the patch changes, and the patch may disrupt normal software operation (but allow the network to be relatively free of worm traffic). That doesn't keep the business running, however. Finally, it doesn't directly provide any way to repair infected hosts, it only provides immunity against the worm for uninfected hosts. I'm leary of this being as effective in the real world as it is in the lab.

Overall this is a well written paper from a respected research group and worth studying.

Fighting Fire with Fire: Designing a "Good" Computer Virus

We continue in our series on good worms and simulated outbreaks with a paper posted in October, 2004, to InformIT:

Computer viruses have outgrown traditional antivirus methods. Despite the widespread use of antivirus software, viruses still cause billions of dollars in damage each year. To counter the threat, this article offers suggestions for designing and testing unique, computer-based solutions inspired by the field of biology. Specifically, we describe ideas for designing and testing a live, attenuated computer virus vaccine, including methods for successfully testing the vaccine using real-world simulation.

Source: Fighting Fire with Fire: Designing a "Good" Computer Virus, Oct 15, 2004 By Cyrus Peikari.

An interesting and well researched apper, although I still doubt the efficacy of such a method in the real world.

Fast Detection and Reaction to Scanning Worms

Worm detection and response systems must act quickly to identify and quarantine scanning worms, as when left unchecked such worms have been able to infect the majority of vulnerable hosts on the Internet in a matter of minutes. We present a hybrid approach to detecting scanning worms that integrates significant improvements we have made to two existing techniques: sequential hypothesis testing and connection rate limiting. Our results show that this two-pronged approach successfully restricts the number of scans that a worm can complete, is highly effective, and has a low false alarm rate.

Source: Fast Detection of Scanning Worm Infections, Jaeyeon Jung, Stuart E. Schechter, and Arthur W. Berger. (Google cache)

This approach, using a combined effort of slowing down the worm once it's been detected and actively quarantining it, makes sense. Their paper is worth a read if you want to look at what may prove to be a successful a priori worm defense mechanism for aggressively scanning worms. It may not work for some slowly scanning or hitlist worms (ie application layer worms), but it's worthwhile.

Peer-to-Peer Traffic and Worms

From Kannan and Lakshminarayanan comes an interesting paper out of their CS project from Autumn, 2003.

Recently, two trends have emerged in the field of peer-to-peer networks: widespread deployment of peer-to-peer systems for file sharing and development of distributed hash tables that provide efficient lookups. In this paper, we study how to harness the power of these technologies to further the state-ofthe- art in both designing and defending against Internet worms. We quantify this advance from three different viewpoints. Firstly, peer-to-peer traffic characteristics differs from traditional Internet traffic in several aspects, and we quantitatively analyze the effect of these differences on worm propagation and control. Secondly, we show that a DHT is an ideal model for coordination among worms, and design a DHT-enabled worm that is an improvement over existing worm designs in a number of aspects, mainly stealth in propagation and speed of propagation. Our DHT-based worm designs can be used to implement a variety of policies aimed at circumventing existing schemes for worm propagation control. Our results also show that a coordinated worm can spread more than twice as fast as worms such as Slammer, while halving the number of unsuccessful probes. In this way, this paper attempts to “raise the bar” in worm design, and this is essential to the development of suitable defenses. Finally, we offer some preliminary insights on how a DHT can be used to be defend against worms

Source: Implications of Peer-to-Peer Networks on Worm Attacks and Defenses, Jayanthkumar Kannan and Karthik Lakshminarayanan.

This paper is interesting because it explores and analyzes the possibility of using a distributed hash tabe to coordinate worm activity. Previously this had been largely the field of speculation and conjecture. Their results are worth reading.

A very related paper is from Wei Yu, Corey Boyer, and  Dong Xuan:

Recent active worm propagation events show that active worms can spread in an automated fashion and flood the Internet in a very short period of time. Due to the recent surge of Peer-to-Peer (P2P) systems with large numbers of users, P2P systems can be a potential vehicle for the active worm attacker to achieve fast worm propagation in the Internet. In this paper, we address the issue by studying the impact of P2P systems on propagation of active worm attacks. In particular: 1) we define the P2P-based attack model and study two P2P-based attack strategies; 2) we develop an analytical approach to analyze the impact of P2P-based attack mechanisms and P2P related factors such as size, vulnerability, topology degree, and the structured/unstructured property. Based on numerical results, we observe that a P2P-based attack can significantly worsen attack effects (improve the attack performance) and some P2P related parameters also have an impact on worm attack effects. Our initial work is the first study providing the guidance for P2P systems to address worm attack concerns.

Source: Analyzing Impacts of Peer-to-Peer Systems on Propagation of Active Worm Attacks, Wei Yu, Corey Boyer, Dong Xuan.

Both of these papers are interesting from the standpoint of topology effects on worm propagation.

Worm Detection and Quarantine using DEWP

Chen and Heidemann have developed a worm detection system called DEWP, described as such:

In this paper, we present DEWP, a router-based system designed to automatically detect and quarantine Internet worm propagation. DEWP detects worm probing traffic by matching destination port numbers between incoming and outgoing connections. This approach does not require knowledge of worm packet contents or profiles of normal traffic conditions; it can automatically detect and suppress worms due to their unusual traffic patterns. We describe how DEWP works and evaluate its effectiveness. We study the speed of detection and vulnerable host protection relative to factors including worm scanning techniques, DEWP deployment coverage and detection interval. We also investigate false detections with network trace playback. Through simulations, we show that DEWP detects worm propagation within about 4 seconds. By blocking worm probing traffic automatically, DEWP can automatically protect more than 99% hosts from being infected by random-scanning worms.

Source: Detecting Early Worm Propagation through Packet Matching, Xuan Chen and John Heidemann.

Like other worm detection systems, DEWP expects that worms will send significant numbers of probe packets which will fail. This assumption breaks down for hitlist or network aware worms, such as IM, mail, or Windows filesharing worms.

Essentially this makes DEWP a large scale scan detector, meaning it must keep and periodically analyze the state information. This will cause a significant overhead in routing and switching performance, which is typically stateless, unless it is deployed on deep enough of a subnet edge that it can track that many states easily. Note that a /16 with actively scanning worm hosts will explode the state on a typical firewall beyond approximate 75,000 states (including normal network traffic as the baseline) rapidly. This gives such a system a significant hurdle to overcome if it is to be successfully deployed on a production network

Detecting Worms with Various Scan Techniques

Since the days of the Morris worm, the spread of malicious code has been the most imminent menace to the Internet. Worms use various scanning methods to spread rapidly. Worms that select scan destinations carefully can cause more damage than worms employing random scan. This paper analyzes various scan techniques. We then propose a generic worm detection architecture that monitors malicious activities. We propose and evaluate an algorithm to detect the spread of worms using real time traces and simulations. We find that our solution can detect worm activities when only 4% of the vulnerable machines are infected. Our results bring insight on the future battle against worm attacks.

Source: An Effective Architecture and Algorithm for Detecting Worms with Various Scan Techniques, Jiang Wu, Sarma Vangala, Lixin Gao, and Kevin Kwiat.

This is the kind of approach I like best: generic, so it can detect de novo worms, and something that's attempted to make an abstract description of the worm problem.

Scalable High Performance Network Monitoring

Large scale network monitoring for threat identification is always an interesting topic.

In a cost-effective way, collecting and analyzing data from such a nationwide operational network as China Education and Research Network (CERNET ) is an increasingly challenging task. This paper presents our experience designing and implementing a passive monitoring agent applicable to CERNET, based on which we are not only supporting our network intrusion detection system (IDS), network management system (NMS) for detecting and identifying signs of malicious activities, non-malicious failures, and other exceptional events in real-time, but providing anomaly information to accounting and billing system (ABS) so as to make it healthy. This agent is characterized by a high performance data collecting facility and a methodology of real-time data correlation and analysis. We can deploy a customized agent on a particular link of CERNET for monitoring network dynamically. We will discuss how to conflate, correlate, associate and refine measurement data to discriminate anomalies such as DoS from normal traffic, and how to respond to the anomalies for the purpose of operational network's health. We conclude with experiences learned from the development and deployment of the agent and ongoing research work.

Source: A Scalable High Performance Network Monitoring Agent for CERNET, Hui Zhang.

This one is worth a read because only a handful of such designs see real world use and continued refinement. Anyone interested in performing such large-scale network instrumentation should examine this approach.

An Analysis of the Slapper Worm

While the Slapper worm is nothing new (it appeared in late 2002), this paper is still a worthwhile read.

We can prove that the Slapper is a variation of the Apache Scalper worm by comparing the source code. Modifications introduced in the Slapper worm improved the robustness and efficiency of its predecessor's simplistic P2P networking capabilities. Slapper's author also removed certain features from the original-either because they were redundant or to reduce the perception that it was a tool developed to cause direct harm to networks. Among the features the author removed from the Slapper were capabilities to update itself from a remotely specified Web server (perhaps to prevent someone else from replacing this version with a new one), to attack and infect a host specified with a controlling program, and to send spans. Interestingly, the ability to execute distributed denial-of-service attacks on a controlling user's behalf was kept intact. Slapper's author attempted to make communications with a remote controlling program as stealthy and untraceable as possible by removing several commands to query status and obtain feedback from Slapper nodes.

Source: An analysis of the Slapper worm, Arce, I. and Levy, E., Security & Privacy Magazine, IEEE, Jan.-Feb. 2003, pages 82- 87. (Not available from free from the IEEE.)

Slapper, while not successful at spreading far, showed an integration of several features that made it a curious worm to study. This is the best analysis available on the worm.

Routing Instabilities and Worms

Several studies have been performed on global routing instabilities caused by worm outbreaks.

Instability can be induced from without as well as within. In July 2001 the Internet worm known as Code Red 2 (CRv2) spread across the globe. It exploited holes in the Microsoft IIS server to gain access and port itself to a machine. Once on-board it randomly chose IP addresses looking for other computers running IIS with the same access vulnerability, and continued the propagation. The intensity of the attack could be monitored as a function of time by sniffing network traffic in a given domain for scans (i.e. a particular type of connection request) that were characteristic of the worm. Another worm, Nimda, struck in September 2001. It propagated in a similar fashion, using a larger arsenal of vulnerabilities and a faster means of spreading across the Internet. Temporal correlation between these two worm attacks routing instability was noticed by researchers at Renesys Corporation[2]. Figure 1 illustrates an example that plots the number of route withdrawals per 30 second time interval observed at one router, against the rate of .probes. generated by Nimda in the same time period, observed in one network. It turns out that this spike in withdrawals occurs in a wave, across routers situated all over the globe. Recall that a router withdraws a route to an AS only when it cannot reach that AS. The global wave shows that somehow the traffic induced by the worm caused a wave of distress among the routers.

Source: Challenges In Using Simulation to Explain Global Routing Instabilities, David M. Nicol.

Additional measurements have been made for specific worm outbreaks:

This paper examines the surge in BGP updates that coincide with events such as the recent Internet worm attacks. Although the Internet routing infrastructure was not a direct target of the January 2003 Slammer worm attack, the worm attack coincided in time with a large increase in the number of BGP routing update messages observed globally. Our analysis shows that the current global routing protocol BGP allows local connectivity dynamics to propagate globally. As a result, any small number of edge networks can potentially cause wide-scale routing overload. For example, two small edges ASes, which announced less than 0.25% of BGP routing table entries, contributed over 6% of total update messages during the worm attack as observed at the major monitoring points. Although BGP route flap damping has been proposed to eliminate such undesirable global consequences of edge instability, our analysis shows that damping has not been fully deployed even within the Internet core. Our simulation further reveals that partial deployment of BGP damping not only has limited effect but may also worsen the routing performance under certain topological conditions. The results show that it remains a research challenge to design a routing protocol that can prevent local dynamics from triggering global messages in order to scale well in a large, dynamic environment.

Source: Analysis of BGP Update Surge during Slammer Worm Attack, Mohit Lad, Xiaoliang Zhao, Beichuan Zhang, Dan Massey, and Lixia Zhang.

We speculate that, although most of the traffic in the Internet continued to flow normally through the small fraction of links that make up the global backbones, most of the links at the Internet edge had serious performance problems during the worms' probing and propagation phases. A complete list of reasons still needs to be documented, but we suspect i) congestion-induced failures of BGP sessions due to timeouts; ii) flow-diversity induced failures of BGP sesions due to router CPU overloads; iii) proactive disconnection of certain networks; and iv) failures of other equipment at the Internet edge such as DSL routers and other devices.

Source: Global Routing Instabilities during Code Red II and Nimda Worm Propagation, James Cowie, Andy Ogielski, BJ Premore and Yougu Yuan.

Given the number of worm outbreaks in the past four years, the amount of global routing instability that ensures is rare. However, when it does happen, several thousand BGP routes are dropped and up to 36 hours pass before stablity is fully restored. An interesting phenomenon.

Curious Yellow: The First Coordinated Worm Design

Another worst case scenario for worms:

The Warhol worm design began the theoretical discussion of so-called "superworms", a new type of computer worms. A worm is a computer program which copies itself from computer to computer in an attempt to reproduce as much as possible. A superworm uses more advanced techniques to achieve very quick infection of the network. The primary strategy behind the Warhol superworm is to pre-scan the network for vulnerable targets. When the worm is launched it already has a large list of targets with a known method for infection and can therefore quickly infect an initial seed population.

One thing which the Warhol paper mentions is that better results might be achieved via a coordinated worm in which various instances of the worm on different computers communicate with each other in order to optimize infection. The Warhol paper states, however, that no coordinated worm has ever been created. This paper proposes the first design for a worm which utilizes efficient communication between worm instances for an optimal infection strategy.

Source: Curious Yellow: The First Coordinated Worm Design, Brandon Wiley.

This is one of many "worst case" scenarios for worms where each individual node communicates with other nodes to ensure that they all work effeiciently. This model is unproven in practice, and open to errors. Nodes can, for instance, be fooled into thinking that they are done when false messages are ijected into the system. The notion of a counter worm to save the Internet, however, is a dangerous notion, as has been presented here early.

A Lab Worm

Again from Georgia Tech, an interesting paper and premise:

Malicious worms have presented a formidable threat to the security community in recent years. Beginners to internet security research require an understanding of the inner workings of worms. A simple research worm designed to run on a test network facilitates this understanding. This worm is also useful to researchers needing see how a typical worm will affect systems. This paper explains the design and implementation of a simple research worm. A discussion of worm structure is provided. Design decisions made in creating our research worm are then given with an emphasis on how they relate to real internet worms. Relevant information from the construction process provides context to the reader. The worm described herein is run on a safe isolated network at the Georgia Institute of Technology. Students in a network security course study it to see worm behavior firsthand and to gauge the effectiveness of different tools at combating worms. This research worm does not attack a real network service, thus it is harmless if ever run on a network connected to the Internet.

Source: Design and Implementation of a Lab Worm (Google HTML cache, original PDF is unavailable), Christopher Church, Tim Schmoyer,  and Henry L. Owen.

Such a system is a fantastic idea, and should be investigated for more thorough study. If anyone has any additional information on such a system, please feel free to share.

Automatically Repairing Compromised Network Nodes

Another interesting paper which attempts to examine traditional security approaches in light of fast moving, widespread attacks and infections.

The widely accepted method to repair a compromised system is to wipe the system clean and reinstall. We think that there may be alternative methods. Specifically, we envision systems that are capable of automatically recovering from system compromises. Our proposed approach is a repair agent that resides in an isolated area on the system. We use a virtual machine approach to isolate the repair agent. The repair agent should roll back any undesirable changes, determine the point of entry, and prevent further compromise.

Source: Towards an Approach for Automatically Repairing Compromised Network Systems, Julian B. Grizzard, Sven Krasser, Henry L. Owen, Gregory J. Conti,  and Eric R. Dodson.

While there are some questions about how this would be implemented, this does mesh well with current developments in the host-based intrusion prevention realm. While these don't remedy an infection, they do attempt to prevent total system compromise or, if possible, remove the system from arbitrary network access.

Least Effort Strategies for Cybersecurity

An interesting paper from GMU which examines the cost-benefit ratio of security in light of widespread attacks.

Cybersecurity is an issue of increasing concern since the events of September 11th. Many questions have been raised concerning the security of the Internet and the rest of US’s information infrastructure. This paper begins to examine the issue by analyzing the Internet’s autonomous system (AS) map. Using the AS map, malicious infections are simulated and different defense strategies are considered in a cost benefit framework. The results show that protecting the most connected nodes provides significant gains in security and that after the small minority of the most connected nodes are protected there are diminishing returns for further protection. Although if parts of the small minority of the most connected firm are not protected, such as non-US firms, protection levels are significantly decreased.

Source: Least Effort Strategies for Cybersecurity, Sean P. Gorman, Rajendra G. Kulkarni, Laurie A. Schintler, Ph.D., and Roger R. Stough, Ph.D.

This paper takes a large-scale view of the Internet and security, and uses various models for their analysis. An interesting approach which seeks to examine basic questions.

Combatting Mail-Based Malware using Bayesian Filters

And you thought it was just for spam ... since mobile malware has many of the same properties as spam, it's a natural fit.

When most people think of tools to combat malware, very few will give a passing thought to Bayesian Filtering, why?

Common reasons include:

• They don’t realize that Bayesian Filtering can be used against malware (viruses, Trojans, worms, etc.)
• They are just for spam.
• They don’t know how to train them for malware.

This paper will investigate the use of Bayesian Filtering, specifically to counter/block/detect malware. What’s more, this paper will focus on tools such as POPfile and SpamPal (which are free anti-spam systems available for both UNIX and Windows).

The use of Bayesian Filtering systems can be extremely useful in cases of fast burning or very complex malware outbreaks as a stop-gap until the anti-virus vendors manage to get reliable updates out to their customers.

Bayesian Filtering of internal mail can also be useful in identifying infected systems in your organization that need remedial action before the ‘trickle’ of infections become a ‘torrent’ and you are left fighting to keep your head above the rising waters.

The paper will include statistics clearly showing the accuracy of Bayesian Filtering, not just for malware, but also SPAM and 419 advance-fee-frauds too.

Source: Canning More Than SPAM With Bayesian Filtering, Martin Overton. Appeared at the Virus Bulletin conference in 2004.

Several Bayesian filtering tools are available. I personally use ifile (for UNIX and POSIX systems), although the most popular one is probably SpamAssassin has used Bayesian methods since the 2.5 series (it is currently at 3.x). Several mail client plugins exist which can make use of Bayesian methods, including many for Microsoft Outlook, Mozilla mail include Bayesian filtering methods, and also for Mail.app on OS X and SpamSieve on OS X. Martin's paper shows how you can use these tools to keep mail-based malware off of your desktop, too. A decent set of links on Bayesian Statistics is available via WikiPedia.

Detecting Worms using DIB:S and ICMP Unreachable Messages

Berk, Gray, and Bakos present a system called DIB:S which can monitor for worms over large networks. Thier system is described as such:

Identification of an Internet worm is a manual process where security analysts must observe and analyze unusual activity on multiple firewalls, intrusion-detection systems or hosts. A worm might not be positively identied until it already has spread to most of the Internet, eliminating many defensive options. In this paper, we present an automated system that can identify active worms seconds or minutes after they first begin to spread, a necessary precursor to halting the spread of a worm, rather than simply cleaning up afterward. Our implemented system collects ICMP Unreachable messages from instrumented network routers, identies those patterns of unreachable messages that indicate malicious scanning activity, and then searches for patterns of scanning activity that indicate a propagating worm. In this paper, we examine the problem of active worms, describe our ICMP-based detection system, and present simulation results that illustrate the speed with which it can detect a worm.

Source: Using Sensor Networks and Data Fusion for Early Detection, Vincent H. Berk, Robert S. Gray, and George Bakos.

While this is an interesting and low-hanging fruit approach, their system only looks for ICMP unreachable messages (forwarded to a centralized collection system). If these are filtered or otherwise not found (ie the worm uses a hitlist to scan), it will fail to detect the worm. While such worms may seem to be uncommon, consider this: any application layer worm essentially has a hitlist granted to it from every infected node, either an IM buddy list or a list of email addresses that the client has contacted. Windows file sharing networks, too, have centralized information about hosts online, allowing a worm to make connection attempts on the local network without hitting hosts that don't exist. Finally, under load many IP stacks will throttle the rate of ICMP message generation, which may dampen the effectiveness of the system. However, using such information allows the detectors to be relatively stateless, allowing them to monitor large numbers of subnets or networks. If the worm generates enough ICMP messages in a short enough time frame, the rate of collection of these messages at the TRAFEN analsysi subsystem may trigger an alert.

Detecting Worms with the Willow Architecture

Another distributed worm detection system. This one is called Willow and its use in detecting worms is described in a paper by Scandariato and Knight (which appeared at SRDS 2004, 23rd Symposium on Reliable Distributed Systems Florianopolis, Brazil, October 2004):

Many areas of society have become heavily dependent on services such as transportation facilities, utilities and so on that are implemented in part by large numbers of computers and communications links. Both past incidents and research studies show that a well-engineered Internet worm can disable such systems in a fairly simple way and, most notably, in a matter of a few minutes. This indicates the need for defenses against worms but their speed rules out the possibility of manually countering worm outbreaks. We present a platform that emulates the epidemic behavior of Internet active worms. For purposes of experimentation, the platform has been deployed on a cluster of computers to emulate worm outbreaks in very large networks. A wide variety of worm properties can be studied and network topologies of interest constructed. A reactive control system, based on the Willow architecture and the OOPS policy framework, operates on top of the platform and provides a monitor/analyze/respond approach to deal with infections automatically. The logic driving the control system is synthesized from a formal specification, which is based on control rules correlating sensor events. Details of our highly configurable platform, the theory of operation of the Willow architecture, the features of the specification language, and various experimental performance results are presented.

Source: The Design and Evaluation of a Defense System for Internet Worms, Riccardo Scandariato and John C. Knight.

The Willow architecture is designed to detect de novo worms by monitoring for failures in scanning activity. This should work for most existing worms, but relying on this as a detection feature can be fatal if hitlist-only worms are widely deployed. However, since WIllow attempts to provide a means to improve network survivability when under attack, this is a reasonable foundation to use.

Even More "Good Worm" Papers

An interesting paper by Nicol and Liljenstam makes a decent theoretical case for a defensive worm. This paper takes into account various forms of an active defensive worm. It ignores any ethical or legal implications of such a worm and only provides an analytical model.

The recent proliferation of Internet worms has raised questions about defensive measures. To date most techniques proposed are passive, in-so-far as they attempt to block or slow a worm, or detect and filter it. Active defenses take the battle to the worm—trying to eliminate or isolate infected hosts, and/or automatically and actively patch susceptible but as-yet-uninfected hosts, without the knowledge of the host’s owner. The concept of active defenses raises important legal and ethical questions that may have inhibited consideration for general use in the Internet. However, active defense may have immediate application when con- fined to dedicated networks owned by an enterprise or government agency. In this paper we model the behavior and effectiveness of different active worm defenses. Using a discrete stochastic model we prove that these approaches can be strongly ordered in terms of their worm-fighting capability. Using a continuous model we consider effectiveness in terms of the number of hosts that are protected from infection, the total network bandwidth consumed by the worms and the defenses, and the peak scanning rate the network endures while the worms and defenses battle. We develop optimality results, and quantitative bounds on defense performance. Our work lays a mathematical foundation for further work in analysis of active worm defense.

Source: Models of Active Worm Defenses, David M. Nicol and Michael Liljenstam. This paper is related to their paper listed in an October, 2004, rundown of papers on this blog.

Their paper finds a number of interesting conclusions, but also notes that they fail to address truly real world scenarios. These include detecting the worm's initial outbreak and how rapidly a counterworm can be deployed.

More Papers on Worm Outbreak Simulations and Modeling

Some more on the topic of simulating worm outbreaks that we posted on Saturday. Here's a few papers on the subject covering the two tools I listed (SSFNet, ns2) and others, as well as theoretical modeling of worm propagation. What this provides researchers with is a way to understand the likely impact of a new worm, how we can change our network topologies and infrastructures to be both resistant to worm outbreaks and even integrate defensive tools into the networks.

Abstract modeling, such as using epidemic models, has been the general method of choice for understanding and analyzing the high-level effects of worms. However, high-fidelity models, such as packet-level models, are indispensable for moving beyond aggregate effects, to capture finer nuances and complexities associated with known and future worms in realistic network environments. Here, we first identify the spectrum of available alternatives for worm modeling, and classify them according to their scalability and fidelity. Among them, we focus on three high-fidelity methods for modeling of worms, and study their effectiveness with respect to scalability. Employing these methods, we are then able to, respectively, achieve some of the largest packet-level simulations of worm models to date; implant and attack actual worm monitoring/defense installations inside large simulated networks; and identify a workaround for real-time requirement that fundamentally constrains worm modeling at the highest fidelity levels.

Source: High-Fidelity Modeling of Computer Network Worms, Kalyan S. Perumalla, Srikanth Sundaragopalan.

In this paper, we investigate epidemiological models to reason about computer viral propagation. We extend the classical homogeneous models to incorporate two timing parameters: Infection delay and user vigilance. We show that these timing parameters greatly influence the propagation of viral epidemics, and that the explicit treatment of these parameters gives rise to a more realistic and accurate propagation model. We validate the new model with simulation analysis.

Source: Modeling the Effects of Timing Parameters on Virus Propagation, Yang Wang, Chenxi Wang.

Email viruses constitute one of the major Internet security problems. In this paper we present an email virus model that accounts for the behaviors of email users, such as email checking frequency and the probability of opening an email attachment. Email viruses spread over a logical network defined by email address books. The topology of email network plays an important role in determining the behavior of an email virus spreading. Our observations suggest that the node degrees in an email network are heavy-tailed distributed and we model it as a power law network. We compare email virus propagation on three topologies: power law, small world and random graph topologies.  The impact of the power law topology on the spread of email viruses is mixed: email viruses spread more quickly than on a small world or a random graph topology but immunization defense against viruses is more effective on a power law topology.

Source: Email Virus Propagation Modeling and Analysis, Cliff C. Zou, Don Towsley, Weibo Gong.

An unexpected consequence of recent worm attacks on the Internet was that the routing infrastructure showed evidence of increased BGP announcement churn. As worm propagation dynamics are a function of the topology of a very large-scale network, a faithful simulation model must capture salient features at a variety of resolution scales. This paper describes our efforts to model worm propagation and its affect on routers and application traffic. Using our implementations of the Scalable Simulation Framework (SSF) API, we model worm propagation, its affect on the routing infrastructure and its affect on application traffic using multiscale traffic models.

Source: Multiscale modeling and simulation of worm effects on the internet routing infrastructure, David M. Nicol, Michael Liljenstam, and Jason Liu.

Reproducing the effects of large-scale worm attacks in a laboratory setup in a realistic and reproducible manner is an important issue for the development of worm detection and defense systems. In this paper, we describe a worm simulation model we are developing to accurately model the large-scale spread dynamics of a worm and many aspects of its detailed effects on the network. We can model slow or fast worms with realistic scan rates on realistic IP address spaces and selectively model local detailed network behavior. We show how it can be used to generate realistic input traffic for a working prototype worm detection and tracking system, the Dartmouth ICMP BCC: System/Tracking and Fusion Engine (DIB:S/TRAFEN), allowing performance evaluation of the system under realistic conditions. Thus, we can answer important design questions relating to necessary detector coverage and noise filtering without deploying and operating a full system. Our experiments indicate that the tracking algorithms currently implemented in the DIB:S/TRAFEN system could detect attacks such as Code Red v2 and Sapphire/Slammer very early, even when monitoring a quite limited portion of the address space, but more sophisticated algorithms are being constructed to reduce the risk of false positives in the presence of significant "background noise" scanning.

Source: Simulating realistic network worm traffic for worm warning system design and testing, Michael Liljenstam, David M. Nicol, Vincent H. Berk, Robert S. Gray. (Note that this is article requires payment to receive.)

Large-scale worm infestations, such as last year.s Code Red, Code Red II, and Nimda, have led to increased interest in modeling these events to assess threat levels, evaluate countermeasures and investigate possible influence on the Internet infrastructure. However, the inherently large scale of these phenomena pose significant challenges for models that include infrastructure detail. We explore the use of selective abstraction through epidemiological models in conjunction with detailed protocol models as a means to scale up simulations to a point where we can ask meaningful questions regarding a hypothesized link between worms and inter-domain routing instability. We find that this approach shows significant promise, in contrast to some of our early attempts using all-out packet level models. We also describe some approaches we are taking to collect the underlying data for our models.

Source: A Mixed Abstraction Level Simulation Model of Large-Scale Internet Worm Infestations, Michael Liljenstam, Yougu Yuan, BJ Premore, David Nicol.

The Code Red worm incident of July 2001 has stimulated activities to model and analyze Internet worm propagation. In this paper we provide a careful analysis of Code Red propagation by accounting for two factors: one is the dynamic countermeasures taken by ISPs and users; the other is the slowed down worm infection rate because Code Red rampant propagation caused congestion and troubles to some routers. Based on the classical epidemic Kermack-Mckendrick model, we derive a general Internet worm model called the two-factor worm model. Simulations and numerical solutions of the two-factor worm model match the observed data of Code Red worm better than previous models do. This model leads to a better understanding and prediction of the scale and speed of Internet worm spreading.

Source: Code red worm propagation modeling and analysis, Cliff Changchun Zou, Weibo Gong, Don Towsley.

In recent years, fast spreading worms have become one of the major threats to the security of the Internet. In order to defend against future worms, it is important to understand how worms propagate and how different scanning strategies affect their propagation. In this paper, we model and analyze worm propagation under various scanning strategies, such as idealized scan, uniform scan, divide-andconquer scan, local preference scan, sequential scan, target scan, etc. We also analyze and discuss how attackers could optimize their scanning strategies, and provide some guidelines for building up a monitoring infrastructure to defend against future worms.

Source: On the Performance of Internet Worm Scanning Strategies, Cliff Changchun Zou, Don Towsley, Weibo Gong.

More on the "Good Worm"

Some more materials on the concepts of the good worm. These are two slide decks on the topic.

In The coming age of defensive worms [PPT], David Meltzer (Intrusec Security) lays out a decent case for the use of counter-worms as a defense mechanism.

And in The Case for Beneficial Computer Viruses and Worms: A Student's Perspective [PDF], the author goes over some of the historical cases evaluating the concept of a beneficial worm.

In either case, I'm still not convinced. While I like agent systems and distributed computing, we have better ways of doing this now. And you still have reliable, trusted mechanisms to distribute updates or changes either in response to a worm outbreak or prior to one. No "beneficial worm" is needed in either case.

Reverse Engineering Bagle

Found via Slashdot, an interesting paper from Konstantinin Rozinov, a researcher with Bell Labs.

We believe that reverse code engineering (RCE) can be used to better analyze viruses and provide us with better techniques to protect against them and their variants. This paper examines the benefits of RCE and how it applies to detecting, preventing, and recovering from a virus. RCE can be defined as analyzing and disassembling a software system in order understand its design, components, and inner-workings. RCE also allows us to see hidden behaviors that cannot be directly observed by running the virus or those actions that have yet to be activated. These benefits can be used to prematurely defeat a virus’s future variants by better analyzing the original virus.

Source: Reverse Code Engineering: An In-depth Analysis of the Bagle Virus, Konstantinin Rozinov.

The author lists a few accomplishments in the paper (page 28) and their method of reverse code engineering (RCE):

1. "We ... learned of the web sites and DNS servers the virus contacts."
   
2. "Through RCE we figured out that Bagle’s main method of propagation is by sending itself out to as many emails as it can find on the victim’s fixed disks. We believe that a file system or other mechanism can be implemented or modified to encrypt certain sensitive data, including emails."
3. "It was also discovered as a result of RCE that when Bagle tried to contact external websites it would use the string “beagle_beagle” as the user agent in the HTTP protocol. This could be monitored for and blocked."

While this paper gives significantly more information than was available in the immediate timeframe after the Bagle.A was released, it highlights a few weaknesses. First, it took plenty of time to disassemble the binary and perform this analysis, and if you waited solely on this then you were suffering pretty significant network disruption due to the virus by the time you were done. Secondly, it revealed little beyond what was gathered with more lightweight analysis, with the most significant understanding coming in the form of the backdoor access the worm provides. Thirdly, they didn't use this to stop any more Bagle variants from coming in.

So is this a bust? Is this a waste? Hardly, but it's wise to remember what happens when a new worm or mail-based attack comes out in wide circulation. Administrators take action to stop the worm using simple checks, such as header checks or filename checks. Some sites simply deny all attachments as a draconian measure that's effective (and effective at stopping a good deal of work using email or the network). They deny the traffic if at all possible. In the case of a mail-based virus or worm, they stop direct to MX mailers by stopping unauthorized SMTP port usage. Once the AV or IDS companies have provided a signature they install it and begin using it. They clean the affected systems.

What these administrators don't do is capture the binary and perform any significant analysis on it to gain a deep understanding of the threat, they simply take action to preserve the network or the resource.

This work isn't a bust for a few reasons. First it's one the best writeups of reverse engineering malware I have yet encountered. You'll learn about x86 assembly and reverse engineering, how to use IDS Pro, and all manner of analysis. This should get you started. Secondly, it's an in depth treatment of a threat that is still out there, even if it's mutated and been released as variants beyond immediate recognition. Thirdly, it highlights one possible approach to real-time defense mechanisms.

Would this work in real time, ie some analysis of binaries to do on-the-fly comparisons and determine related code pieces? Probably not at any level that would scale well, but it can be done after the fact to determine variants, as descirbed by the F-Secure team on their weblog. Using graph isomorphism analysis one can make this more sophisticated, but this still assumes that the graphs will be reasonably close to eachother. And it's time consuming, so much so that on the fly you'd have difficulty in keeping up with a high speed mail link. And the initial categorization as "undesirable threat" still must be done manually for every family or seed of graphs.

So where does that leave us? With a good tutorial on the subject, and knowledge that in a short time viruses that evade such analysis and detection will emerge.

Worm Anatomies and Structures

How to think about worms, in terms of what they are composed of and how they are put together, has been on my mind for a few years. Compare these two descriptions:

We present a general framework for reasoning about network worms and analyzing the potency of worms within a specific network. First, we present a discussion of the life cycle of a worm based on a survey of contemporary worms. We build on that life cycle by developing a relational model that associates worm parameters, attributes of the environment, and the subsequent potency of the worm. We then provide a worm analytic framework that captures the generalized mechanical process a worm goes through while moving through a specific environment and its state as it does so. The key contribution of this work is a worm analytic framework. This framework can be used to evaluate worm potency and develop and validate defensive countermeasures and postures in both static and dynamic worm conflict. This framework will be implemented in a modeling and simulation language in order to evaluate the potency of specific worms within an environment.

Source: Worm Anatomy and Model, by Dan Ellis, presented at WORM03.

Compare this with the model that we devised in 2001:

Network worms, simple slang terminology for automated intrusion agents, represent a persistent threat to a growing Internet in an increasingly networked world. However, their evolution has been somewhat limited, and they still rely on the same basic paradigms, which contain fundamental flaws. We analyze the basic components of a worm and apply this analysis to three worms found in the wild on the Internet. We then proceed to analyze the limiting factors of existing worm paradigms and outline new ideas which we expect to become prevalent. These new worms will prove to be more difficult to identify and eradicate. It is our intention in sharing this knowledge to stimulate the development of strategies to detect and counteract the threat of smarter network worms.

Source: The Future of Internet Worms, Jose Nazario, with Jeremy Anderson, Rick Wash and Chris Connelly, presented at Blackhat 2001 (Las Vegas).

What's interesting about these is that they're somewhat complementary, but I find that Ellis' model is much more useful than the one I developed. While I tend to think about the characteristics of worm in terms of these five or six attributes (attack, propagation, recon, etc..) I find that Ellis' terminology and mechanism makes more sense for me, at least when I think about modelling the behavior of a worm on the loose. Note that not all of these characteristics are required for a worm to exist, but they do make it more nefarious.

Third Workshop on Hot Topics in Networks

Coming up this Monday and Tuesday is HotNets-III: Third Workshop on Hot Topics in Networks. The workshop describes itself as such:

The Third Workshop on Hot Topics in Networks, HotNets-III, will bring together researchers in the networking and distributed systems community to debate emerging research directions. The goal of the workshop is to promote community-wide discussion of ideas that will influence and foster continued research in the field. The workshop will provide a venue for researchers to present new ideas that have the potential to significantly impact the community in the long term, especially those that are architectural or design-oriented in nature.

Three papers on the agenda are concerned with the worm problem and wormblog readers:

Worm containment must be automatic because worms can spread too fast for humans to respond. Recent work has proposed a network centric approach to automated worm containment: network traffic is analyzed to derive a packet classifier that blocks (or rate-limits) worm propagation. This approach has fundamental limitations because the analysis has no information about the application vulnerabilities exploited by worms. This paper proposes Vigilante, a new host centric approach for automatic worm containment that addresses these limitations. Vigilante relies on collaborative worm detection at end hosts in the Internet but does not require hosts to trust each other. Hosts detect worms by analyzing attempts to infect applications and broadcast self-certifying alerts (SCAs) when they detect a worm. SCAs are automatically generated machine-verifiable proofs of vulnerability; they can be independently and inexpensively verified by any host. Hosts can use SCAs to generate filters or patches that prevent infection. We present preliminary results showing that Vigilante can effectively contain fast spreading worms that exploit unknown vulnerabilities.

Source: Can we contain Internet worms?, Manuel Costa, Jon Crowcroft, Miguel Castro, and Antony Rowstron.

The world of network security is an arms race where attackers constantly change the signatures of their attacks to avoid detection. Aiding the white-hats in this race is one fundamental invariant across all network attacks (present and future): for the attack to progress there must be communication among attacker, the associated set of compromised hosts and the victim(s), and this communication is visible to the network. We argue that the Internet architecture should be extended to include auditing mechanisms that enable the forensic analysis of network data, with a goal of identifying the true originator of each attack . even if the attacker recruits innocent hosts as zombies or stepping stones to propagate the attack. In this paper we outline an approach to the problem of Attacker Identification and Attack Reconstruction, describe the challenges involved, and explain our efforts that show the promise of this approach.

Source: Toward a Framework for Internet Forensic Analysis, Vyas Sekar, Yinglian Xie, David A. Maltz, Michael K. Reiter, and Hui Zhang.

There have been a number of recent proposals for distributed monitoring infrastructures. We argue that a vital missing component from these proposals is a distributed triggering mechanism, by which nodes in the system can proactively work together to maintain invariants and constraints over the system-wide behavior. Without such a triggering component, existing proposals are doomed to poor performance, high detection latency, or both.

A key research challenge in building such a triggering mechanism lies in devising solutions whereby individual nodes can independently detect (and react to) violations of constraints that are denied in terms of the aggregate behavior of nodes in the system. We discuss our early efforts in designing such a triggering system and the research challenges that lie ahead.

Source: A Wakeup Call for Internet Monitoring Systems: The Case for Distributed Triggers, Ankur Jain, Joseph M. Hellerstein, Sylvia Ratnasamy, and David Wetherall.

 

This workshop appears quite interesting and worthwhile to review, and if you get a chance, you should go (either this year, if you needed an excuse to run off to San Diego, or next year) and look at the work being presented and maybe even share your own.

Thanks, Evan, for pointing this workshop out.

Worm Charming: Taking SMB Lure To The Next Level

Over the last two years, worms have resurfaced as a major headache, especially for the companies that get hit by them. Worms aren’t new; they have been around since almost the dawn of computing. With the likes of Nimda, CodeRed, and last years quietly successful worm, Opaserv the rules have changed and the stakes are now significantly higher than ever before.

This paper will use the SMB Lure design as presented by John Morris of Nortel Networks at VB2002 as a staring point and cover how it can be extended to improve its usefulness, not just to corporates but also to researchers in the AV companies, these improvements will include:

• Sample Capture, via custom scripts/tools.
• Sample Recognition, MD5 hashes and anti-virus tools and storage.
• Integration with other technologies, such as IDS, Integrity Checking, anti-virus and custom scripts and other useful tools.
• Automation

By the time that VB2003 arrives a prototype system, based on the technologies and methodologies mentioned above will have been running for almost a year, so there should be some very interesting statistics as well as lessons learnt along the way to share……

Early statistics and information obtained using a very early version of this system was used in the article entitled “Are You Being [Opa]Serve[d]?” in the January 2003 edition of Virus Bulletin magazine.

Source: Worm Charming: Taking SMB Lure To The Next Level, Martin Overton, IBM Global Services, UK (Global Virus Emergency Response Team).

The author pointed out this paper to me, I hadn't noticed it before. However, it's a great paper and demonstration of how a simple worm capture system can be built using low cost tools (ie UN*X, SAMBA, filesystem integrity checking tools). You can couple this to an AV scanner, either commercial or open source, and identify the malware, too, by signature.

All in all a nice, simple, and effective approach to network worm detection. This paper also contains example configurations and lots of useful, practical links.

The Case for Using Layered Defenses to Stop Worms

The US NSA is getting into the worm space some more with a decent size paper on the subject.

For this paper, we studied current worm strategies and implementations and tried to determine whether the trends point to a significant worsening of the problem in the near future. Are worm technologies improving? Are worm attacks becoming more sophisticated? We were also interested in defensive technologies that can be used to combat the worm problem. Where are defensive technologies best applied? Should other technologies be developed to help defend against the worm problem? Ultimately, we would like to know whether a sophisticated attack can be prevented – could current defensive mechanisms be used to defend against future sophisticated attacks?

Source: The Case for Using Layered Defenses to Stop Worms, David J. Albanese, Michael J. Wiacek, Christopher M. Salter, Jeffrey A. Six, National Security Agency.

The paper is interesting, and in some places it's a bit wrong, but overall it's quite a useful piece, although a bit dated in places. Table 7, for example, "Summary of Case Study Results" shows that filesystem and registry integrity checking tools would have been a useful defense against SQLSlammer, yet widespread analysis of it suggests otherwise. Perhaps I need to redo my analysis. Also, while they cite J. Nazario, J. Anderson, R. Wash, C. Connelly, “The Future of Internet Worms” (2001), they didn't cite my book, in which I fix some errors from the paper and clarify a few issues. Nor did they example significant more bodies of research on classification and analysis that are available, nor tools. This paper seems a bit out of sync with the current reality in places.

Access For Sale: A New Class of Worm

Kamal points me at a paper from WORM03 that is telling:

The damage inflicted by viruses and worms has been limited because the payloads that are most lucrative to malware authors have also posed the greatest risks to them. The problem facing authors of this self-reproducing malware is that monetizing each intrusion requires the author to risk communication with the infected system or its owner. The tool of choice for malware authors looking to minimize risk and maximize loot has been the carefully target attack, often employing a trojan horses or attack script. However, attacker’s preferences would likely change if they could infect a large number of systems using a worm and sell access to infected systems to other black hats. We introduce a new type of worm that enables this division of labor, installing a back door on each infected system that opens only when presented a system-specific ticket generated by the worm’s author. The risk to the worm’s author is minimized because he need not communicate with the infected systems. This new class of attack could increase the incentives to write malware and create a market for such specialized skills. In addition to describing this new threat, we propose a number of approaches for defending against it.

Source: Access For Sale: A New Class of Worm, Stuart E. Schechter and Michael D. Smith. Presented at the WORM03 workshop.

This type of observation is nothing new (nor was it when the authors did their work for WORM03). It's how I got started in analyzing worms and analyzing their likely futures, and we're seeing this use at an increased rate. We (and other groups) have detected, for example, correlations between Sasser worm hosts and spam that we receive in our inboxes, showing that these hosts have been used to send or relay spam. After all, if you want to get something widely distributed, you should look at automated it's release and update.

How zombie networks fuel cybercrime, which appeared in a recent issue of The New Scientist, discusses the highly motivated people behind such coordinated actions. As long as such motivations exist and their goals can be achieved, use of worms like this is likely to continue. And that means we'll definitely see more worms in the coming months and years.

The Top Speed of Flash Worms

Flash worms follow a precomputed spread tree using prior knowledge of all systems vulnerable to the worm.s exploit. In previous work we suggested that a flash worm could saturate one million vulnerable hosts on the Internet in under 30 seconds. We grossly over-estimated.

In this paper, we revisit the problem in the context of single packet UDP worms (inspired by Slammer and Witty). Simulating a flash version of Slammer, calibrated by current Internet latency measurements and observed worm packet delivery rates, we show that a worm could saturate 95% of one million vulnerable hosts on the Internet in 510 milliseconds. A similar worm using a TCP based service could 95% saturate in 1.3 seconds.

The speeds above are achieved with flat infection trees and packets sent at line rates. Such worms are vulnerable to recently proposed worm containment techniques. To avoid this, flash worms should slow down and use deeper, narrower trees. We explore the resilience of such spread trees when the list of vulnerable addresses is inaccurate.Finally, we explore the implications of flash worms for containment defenses: such defenses must correlate information from multiple sites in order to detect the worm, but the speed of the worm will defeat this correlation unless a certain fraction of traffic is artificially delayed in case it later proves to be a worm.

Source: The Top Speed of Flash Worms, Stuart Staniford, David Moore, Vern Paxson, Nicholas Weaver. Presented at the WORM04 workshop.

In 2003 at the Virus Bulletin meeting, Neal Hindocha and Eric Chien gave a presentation showing an IM based worm could spread in 30 seconds to all vulnerable systems. It seems like more analysis has convinced the flash worm authors that they're capable of the same thing. I'm skeptical of this, only because networks tend to fail under significant load, assumptions about bandwidth are often inaccurate, and latencies calculated under normal conditions fall apart under stress. Their analysis seems to assume ideal conditions, which aren't always present, and a perfect knowldge of the topology between any source and any target, which is also difficult, if not impossible, to know.

We know that UDP-based worms (like Sapphire and Witty) are capable of spreading quicker than most reaction times and even most detection times. So, which this says that they may be able to spread more quickly, why bother with finding the lower limit and why not work on detecting this sort of things more accurately and on the same time scale?

Toward Understanding Distributed Blackhole Placement

At last week's WORM04 workshop, Evan Cooke presented an interesting paper on some of the meta-findings already yielded from the IMS project.

The monitoring of unused Internet address space has been shown to be an effective method for characterizing Internet threats including Internet worms and DDOS attacks. Because there are no legitimate hosts in an unused address block, traffic must be the result of misconfiguration, backscatter from spoofed source addresses, or scanning from worms and other probing. This paper extends previous work characterizing traffic seen at specific unused address blocks by examining differences observed between these blocks. While past research has attempted to extrapolate the results from a small number of blocks to represent global Internet traffic, we present evidence that distributed address blocks observe dramatically different traffic patterns. This work uses a network of blackhole sensors which are part of the Internet Motion Sensor (IMS) collection infrastructure. These sensors are deployed in networks belonging to service providers, large enterprises, and academic institutions representing a diverse sample of the IPv4 address space. We demonstrate differences in traffic observed along three dimensions: over all protocols and services, over a specific protocol and service, and over a particular worm signature. This evidence is then combined with additional experimentation to build a list of sensor properties providing plausible explanations for these differences. Using these properties, we conclude with recommendations for better understanding the implications of sensor placement.

Source: Toward Understanding Distributed Blackhole Placement, Evan Cooke, Michael Bailey, Z. Morley Mao, David Watson, Farnam Jahanian and Danny McPherson.

This is an important paper because it shows, quite clearly, that blackhole sensors will suffer from effects due to their placement in host address blocks. Any sensor will suffer these effects, and once their understood the data can be more properly analyzed.

Recent worm papers (October, 2004)

Several papers on worm detection and quarantine caught my attention recently. Here are their abstracts and links.

The security of the Internet can be improved using Programmable Logic Devices (PLDs). A platform has been implemented that actively scans and filters Internet traffic for Internet worms and viruses at multi-Gigabit/second rates using the Field-programmable Port Extender (FPX). Modular components implemented with Field Programmable Gate Array (FPGA) logic on the FPX process packet headers and scan for signatures of malicious software (malware) carried in packet payloads. FPGA logic is used to implement circuits that track the state of Internet flows and search for regular expressions and fixed-strings that appear in the content of packets. The FPX contains logic that allows modules to be dynamically reconfigured to scan for new signatures. Network-wide protection is achieved by the deployment of multiple systems throughout the Internet.

Source: Internet Worm and Virus Protection in Dynamically Reconfigurable Hardware, John W. Lockwood, James Moscola, Matthew Kulig, David Reddick, and Tim Brooks, from the Applied Research Laboratory, Washington University, Saint Louis, MO, and Global Velocity, Saint Louis, MO.

---

Recent large-scale and rapidly evolving worm epidemics have led to interest in automated defensive measures against self-propagating network worms. We present models of network worm propagation and defenses that permit us to compare the effectiveness of "passive" measures, attempting to block or slow down a worm, with "active" measures, that attempt to proactively patch hosts or remove infections. We extend relatively simple deterministic epidemic models to include connectivity of the underlying infrastructure, thus permitting us to model quarantining defenses deployed either in customer networks or towards the core of the Internet. We compare defensive strategies in terms of theireffectiveness in preventing worm infections and found that with sufficient deployment, content based quarantining defenses are more effective than the counter-worms we consider. For less ideal deployment or blocking based on addresses, a counter-worm can be more effective if released quickly and aggressively enough. However, active measures (such as counter-worms) also have other technical issues, including causing additional network traffic and increased risk of failures, that need to be considered.

Source: Comparing Passive and Active Worm Defenses, Michael Liljenstam and David M. Nicol, University of Illinois at Urbana-Champaign.

---

As email becomes one of the most convenient and indispensable communication mediums in our life, it is very important to protect email users from increasing email worm attacks. In this paper, we present the architecture and system design of a “feedback email worm defense system” to protect email users in enterprise networks. The defense system is flexible and able to integrate many existing detection techniques to provide effective and efficient email worm defense. First, in response to a “detection score” of a detected worm email and information on the possible appearance of a malicious emailworm in the global Internet, the defense system adaptively chooses a cost-effective defense action that can range from simply labelling this email to aggressively deleting it from an email server. Second, the system uses “honeypot” to thoroughly detect worm emails received by email servers and also to early detect the presence of an email worm in the global Internet. Third, the defense system implements a “multi-sifting detection” technique and “differential email service” to achieve accurate detection without causing much delay on most emails. Furthermore, the defense system separates email attachments from email texts and saves attachments in separate “attachment caching servers”, which facilitate both email worm detection and email service efficiency.

Source: Feedback Email Worm Defense System for Enterprise Networks, Cliff C. Zou, Weibo Gong, Don Towsley.

---

The availability of reliable models of computer virus propagation would prove useful in a number of ways, in order both to predict future threats, and to develop new containment measures. In this paper, we review the most popular models of virus propagation, analyzing the underlying assumptions of each of them, their strengths and their weaknesses. We also introduce a new model, which extends the Random Constant Spread modeling technique, allowing us to draw some conclusions about the behavior of the Internet infrastructure in presence of a self-replicating worm. A comparison of the results of the model with the actual behavior of the infrastructure during recent worm outbreaks is also presented.

Source: LNCS 2965 - Computer Virus Propagation Models, Giuseppe Serazzi and Stefano Zanero, Dipartimento di Elettronica e Informazione, Politecnico di Milano, Milano, Italy. (This entry requires payment to receive or an institutional subscription.)

---

The need for a global monitoring system for Internet worm detection is clear. Likewise, the need for local
detection and response is also obvious. In this study, we used a large data set to review some of the worm monitoring and detection strategies proposed for large networks, and found them difficult to apply to local networks. In particular, the Kalman filter and victimnumber-based approaches proved unsuitable for smaller networks. They are of course appropriate for large systems, but what work well for local networks?

We propose two algorithms tailored for local network monitoring needs. First, the Destination Source Correlation (DSC) algorithm focuses on the infection relation, and tracks real infected hosts (and not merely scans) to provide an accurate response. Second, the HoneyStat system provides a way to track the short-term infection behavior used by worms. Potentially, this provides a basisfor statistical inference about a worm’s behavior on a network.

Source: Worm Detection Using Local Networks, Xinzhou Qin, David Dagon, Guofei Gu, Wenke Lee, Georgia Institute of Technology.

---

We present a payload-based anomaly detector, we call PAYL, for intrusion detection. PAYL models the normal application payload of network traffic in a fully automatic, unsupervised and very effecient fashion. We first compute during a training phase a profile byte frequency distribution and their standard deviation of the application payload flowing to a single host and port. We then use Mahalanobis distance during the detection phase to calculate the similarity of new data against the pre-computed profile. The detector compares this measure against a threshold and generates an alert when the distance of the new input exceeds this threshold. We demonstrate the surprising effectiveness of the method on the 1999 DARPA IDS dataset and a live dataset we collected on the Columbia CS department network. In once case nearly 100% accuracy is achieved with 0.1% false positive rate for port 80 traffic.

Source: Anomalous Payload-based Network Intrusion Detection, Ke Wang, Salvatore J. Stolfo, Computer Science Department, Columbia University.

---

This paper proposes a new approach to detecting aggregated anomalous events by correlating host file system changes across space and time. Our approach is based on a key observation that many host state transitions of interest have both temporal and spatial locality. The intuition is that abnormal state changes, which may be hard to detect in isolation, become apparent when they are correlated with similar changes on other hosts. In particular, the goal is to detect similar, coincident changes to the patterns of file updates that are shared across multiple hosts. We have implemented this approach in a prototype system called Seurat and demonstrated its effectiveness using a combination of real workstation cluster traces gathered over three months, simulated attacks, and a manually launched Linux worm.

Source: Seurat: A Pointillist Approach to Anomaly Detection, Yinglian Xie, Hyang-Ah Kim, David R. O’Hallaron, Michael K. Reiter, and Hui Zhang, Carnegie Mellon University. Also see Seurat: A Pointillist Approach to Anomaly Detection form RAID04.

WORM04 Program Online

The workshop program for WORM04 (the Workshop on Rapid Malware) is now online. The workshop itself is a 1 day event, held on October 29th, 2004 at George Mason University, Fairfax, VA, USA. Speakers include industry and academic participants. You can view the program and see the list of papers that will be presented there. Lots of good topics in detection and quarantine of worms is going to be presented.

Witty growth and decay rate modeled by Zou

Cliff Zou has modeled the Witty worm's propagation using differential equations, accounting for the destructive aspect of the worm. This analysis gives a compelling reason as to the decay rate and accounts for significant portions of the observations. The data used in the analysis comes from the University of Michigan Internet Motion Sensor project's collection.

In our Witty propagation modeling, we have not considered other factors that could possibly affect Witty's propagation. For example, some infected computers could have been patched or filtered out by people before they were crashed by Witty worm.  However, if this factor played a major role, then the I(t) shown in Fig. 2 should have decreased more quickly instead of slower than what our model predicts. Therefore, the same as researchers in [2] said, we believe the rapid decay in the number of active infected hosts is primarily caused by Witty's destructive action.

Source: Witty Worm Progattion Modeling, Cliff C. Zou.

The Spread of the Witty Worm in IEEE S&P;

Witty was the first widespread Internet worm to attack a security product. While technically the use of a buffer overflow exploit is commonplace, the fact that all victims were compromised via their firewall software the day after a vulnerability in that software was publicized indicates that the security model in which end users apply patches to plug security holes is not viable.

In one of the most recent IEEE Security & Privacy magazine issues, a piece covered the March, 2004, Witty worm. In The Spread of the Witty Worm, Colleen Shannon and David Moore, both from the Cooperative Association for Internet Data Analysis (CAIDA), cover the data they collected using their dark IP sensor on the Witty worm's spread. This is almost a complete reprint of their original witty worm analysis, also calledThe Spread of the Witty Worm.

Virus Bulletin Conference 2004 Abstracts

Abstracts for the 2004 Virus Bulletin Conference, taking place September 29 - October 1, 2004, at the Fairmont Chicago, Illinois, are up and look interesting. Here are a few abstracts that may look especially interesting to wormblog readers:

At VB 2003, Neal Hindocha and Eric Chien presented on the dangers of malware for instant messaging (IM). Commenting on the high rate at which this malware could spread, they stated that throttling approaches were unlikely to be successful.

Virus throttling is a technique to slow the spread of worms and viruses that prevents infected machines infecting others. It works well if the traffic generated by a spreading virus (contacting many different machines at high rate) is significantly different from normal traffic. Previous work has shown this technique to work well for most TCP/IP traffic and email. This paper applies the idea to instant messaging.

We have analysed data from the normal usage of a reasonable sized instant messaging server (710 users) and show that throttling is not only possible, but would be effective at slowing and stopping IM malware. We have also analysed the network over which this malware would spread, by looking at the buddy lists of all the users. We show that given the actual network connectivity, IM malware will not spread as quickly or as fully as Hindocha and Chien predict, and that if throttling were used, the effects of malware are much reduced. The throttling solution would be relatively easy to implement at the messaging server.

Source: Virus throttling for instant messaging, Matthew Williamson and Alan Parry.

It should be noted that appearantly AOL and other IM messaging servers already do throttling. You can see this by sending someone messages as fast as you can, you'll be told to come back and try again later.

---

This paper looks very interesting, essentially taking some cues from the human immune system by sampling potential antigens and reacting on the basis of heuristics applied to the observations.

This paper rejects as unrealistic the assumption that unknown novel viruses can be prevented from entering networks, and argues that the best solution to the new and unknown virus problem is rapid detection and elimination of viral spread. It presents a novel and minimally disruptive method to solve this problem that takes a proactive intrusion prevention approach on corporate email systems, and demonstrates an effective defense against a real attack. A user-definable number of records are read from the end of the Exchange Server tracking logs at definable intervals. Originator information is extracted and mapped onto a two-dimensional grid that represents the organizational structure of the company. As well as this being an automated solution the novel visual representation allows an administrator to manually monitor viral spread across the company and drill down to individual client machines. To minimize false positives, any machine emitting an above threshold number of emissions as defined by a user-profile database is quarantined and all suspect sent messages are put into recall on all destination company servers. After viral laboratory analysis of any suspicious sample, messages are allowed to continue or are deleted.

Source: Unknown virus detection and prevention, Paul Hodgson

---

The early email worms did not pay much attention to their target selection. They either picked all names from the address books, or any text similar to an email address from the web browser's cache. If they directly targeted other computers, then the IP address selection was completely random, resulting in a huge percentage of useless probes. Some new worms introduced more careful techniques trying to avoid unnecessary network probes. Overcoming the limitations of email address stores, they started generating possible email addresses themselves. The IP address selection also evolved, first concentrating more on the subnet of the infected computer, then using weighted selection of target subnets. Also, the Internet worms did not bother about the operating environment expect them on the targets. Some new worms already bring with themselves everything that is needed: if they use SMTP to spread, then include an SMTP server inside themselves; if they spread using infected web page, then install a simple web server on the target thus enabling the spread.

Mathematical modelling proves that the success of a worm depends on the initial seeding. Virus authors use various methods (bot networks, email seeding, Usenet) to start up their creations. The presentation will cover in detail these new techniques.

Source: Advanced survival techniques in recent Internet worms, Gabor Szappanos.

---

A good test environment has long been one of the most useful tools at the disposal of a malware researcher. While static disassembly of malicious code is the basis of understanding how it behaves, accurate information can often be derived faster by running the code in an isolated test environment.

The prominence of Internet-aware malicious software has led to several changes in the way malware is analysed. First, the speed at which a threat, such as an Internet worm, can spread, demands immediate information on just how dangerous it is and how it can be mitigated. On top of this, malware tends to rely more on Internet services in order to function. This complicates the process of testing the code in a secure, isolated system.

This paper will discuss using VMWare to create a test environment for malicious code. It will look at using VMWare systems for both automated and manual analysis, specifically concentrating on attempting to create a "virtual Internet". The aim is to fool malware into behaving as it would on the real Internet.

The paper will outline the advantages of such a "Virtual Net" - as well as some of the limitations - when analysing viruses, worms, IRC bots, DDoS agents, "blended threats" and more.

Source: Trapping worms in a virtual net, Hamish O'Dea.

Internet Motion Sensor

One of the things I have had the pleasure of participating in is the Internet Motion Sensor project at the University of Michigan. This project utilizes a novel, distributed architecture to capture and characterize emerging threats like worm propagation.

Networks are increasingly subjected to a broad spectrum of threats that impact the reliability and availability of critical infrastructure. In response, researchers and network operators have increasingly relied on monitoring to characterize and track these threats. This paper introduces the Internet Motion Sensor (IMS), a globally scoped Internet threat monitoring system whose goal is to measure, characterize, and track threats. The dark address sensors in the IMS extend simple passive capture using a novel transport layer service emulation technique to elicit payloads across all services, thereby addressing the issue depth of service coverage. To achieve breadth of coverage, the IMS employs a distributed infrastructure and utilizes sensors that are aware of their address diversity and their position in the actively routed topology. Finally, the IMS uses an innovative signature encoding and data warehousing system combined with a hierarchical architecture to realize a system that is not only time and space efficient, but is also scalable to a global deployment. We explore the various architectural tradeoffs in the context of a 3 year deployment across multiple dark address blocks ranging in size from /24s to a /8. We show how the current architecture emulates services across a diverse set of routed and address topologies in a scalable manner. Results from three recent events are presented to illustrate the utility of such a system: the SCO Denial of Service attacks (December, 2003), the Blaster worm (August, 2003), and the Bagle backdoor scanning efforts (March, 2004).

source: The Internet Motion Sensor: A distributed global scoped Internet threat monitoring system, Evan Cooke, Michael Bailey, David Watson, Jose Nazario, and Farnam Jahanian, in a University of  Michigan CSE Tech Report .

Blaster Revisited (ACM Queue)

A recent issue of the magazine ACM Queue has an interesting piece on the August, 2003, Blaster worm. Written by Jim Morrison, who works for Symantec Security Services, it's a detailed and unboring look at the Blaster worm:

Four hours had passed since the first calls; most of the stores would be closed within the next two hours, giving the techs and developers a chance to work into the night to find the source of the problem. The network administrators were contacted to assist in troubleshooting the problems within the payment systems. Joining the group assembled in the development lab was a member of the security team. He had just been informed of a new worm that was spreading rapidly and reported by the security vendor. Early information indicated that the Microsoft DCOM (distributed component object module) vulnerability had been exploited. The vulnerability was described in Microsoft Security Bulletin MS03-026. The bulletin revealed a buffer overrun using RPC (remote procedure call), remotely using TCP/UDP port 135.

source: Blaster Revisited, ACM Queue vol. 2, no. 4 - June 2004, by Jim Morrison, Symantec Security Services.

Reflections on Witty: Analyzing the Attacker

The current edition of  ;login, the Usenix publication, has a piece by Nick Weaver and Dan Ellis entitred Reflections on Witty: Analyzing the Attacker. it's not much different than the original caida analysis from march, but worth reading:

On March 20th, 2004, an attacker released a single-packet UDP worm, Witty, into the wild.  Although only infecting roughly 12,000 machines, and less than 700 bytes long, this worm represents a dangerous trend in malicious code.  The attack is well understood: there have been several analyses [lurhq, disassembly] of the worm itself, and an excellent analysis by Moore and Shannon on the network propagation [caida_witty], including the presence of seeding or hitlisting (starting the worm on a group of systems to speed the initial propagation).  But what can we learn about the attacker?

thanks to kamal for reminding me.

New Worm Identification

i've been lax in getting this up, USENIX technical was over a week ago. again, some news on worm detection technologies via kamal. Aggregating Detectors for New Worm Identification, Eric Anderson and Jun Li, University of Oregon.

Abstract: Internet worms have resulted in considerable disruption of our communications infrastructure and could cause much more. We propose a design for coordinating a widely distributed set of network monitors to detect the emergence of new high-speed worms, develop and validate signatures for their identification, and model their spreading dynamics in real time. The primary new contribution of our design is a mechanism for going from the observation that there is a possible worm to automatically validating that observation, developing a signature for the worm if one does not already exist, providing a predictive model for the worm's spreading, and statistically quantifying the level of confidence in these characterizations.

i haven't seen it in action, but this looks interesting. we'll see how well it works ...

worm papers at RAID04

the two abstracts below are from RAID04 and come via kamal, who is one of the hack in the box guys:

The need for a global monitoring system for Internet worm detection is clear. Likewise, the need for local Detection and response is also obvious. In this study, We used a large data set to review some of the worm monitoring and detection strategies proposed for large networks, and found them difficult to apply to local networks. In particular, the Kalman filter and victim number-based approaches proved unsuitable for smaller networks. They are of course appropriate for large sysems, but what work well for local networks?

We propose two algorithms tailored for local network monitoring needs. First, the Destination Source Correlation (DSC) algorithm focuses on the infection relation, and tracks real infected hosts (and not merely scans) to provide an accurate response. Second, the HoneyStat system provides a way to track the short-term infection behavior used by worms. Potentially, this provides a basis for statistical inference about a worm's behavior on a network.

source: HoneyStat: Local Worm Detection Using Honeypots, David Dagon, Xinzhou Qin, Guofei Gu, Julian Grizzard, John Levine, Wenke Lee, Henry Owen, Georgia Institute of Technology, USA

---

Worm detection and response systems must act quickly to identify and quarantine scanning worms, as when left unchecked such worms have been able to infect the majority of vulnerable hosts on the Internet in a matter of minutes. We present a hybrid approach to detecting scanning worms that integrates significant improvements we have made to two existing techniques: sequential hypothesis testing and connection rate limiting. Our results show that this two-pronged approach successfully restricts the number of scans that a worm can complete, is highly effective, and has a low false alarm rate.

source: Fast Detection of Scanning Worm Infections, Jaeyeon Jung, Stuart E. Schechter, Arthur W. Berger, MIT, Harvard, USA.

---

i probably wont be at RAID04, but it looks like it could be a good year for presentations. these are just two of the several interesting papers this year. thanks again, kamal.

usenix security 2004 papers

several papers at this year's USENIX security 2004 event look promising for worm detection and containment.

A honeypot is a closely monitored network decoy serving several purposes: it can distract adversaries from more valuable machines on a network, can provide early warning about new attack and exploitation trends, or allow in-depth examination of adversaries during and after exploitation of a honeypot. Deploying a physical honeypot is often time intensive and expensive as different operating systems require specialized hardware and every honeypot requires its own physical system. This paper presents Honeyd, a framework for virtual honeypots that simulates virtual computer systems at the network level. The simulated computer systems appear to run on unallocated network addresses. To deceive network fingerprinting tools, Honeyd simulates the networking stack of different operating systems and can provide arbitrary routing topologies and services for an arbitrary number of virtual systems. This paper discusses Honeyd's design and shows how the Honeyd framework helps in many areas of system security, e.g. detecting and disabling worms, distracting adversaries, or preventing the spread of spam email.

source: A Virtual Honeypot Framework, Niels Provos, from the original CITI tech report which has been updated for USENIX Sec 04.

---

Computer worms -- malicious, self-propagating programs -- represent a significant threat to large networks. One possible defense, containment, seeks to limit a worm's spread by isolating it in a small subsection of the network. In this work we develop containment algorithms suitable for deployment in high-speed, low-cost network hardware. We show that these techniques can stop a scanning host after fewer than 10 scans with a very low false-positive rate. We also augment this approach by devising mechanisms for cooperation that enable multiple containment devices to more effectively detect and respond to an emerging infection. Finally, we discuss ways that a worm can attempt to bypass containment techniques in general, and ours in particular.

source: Very Fast Containment of Scanning Worms, Nicholas Weaver, Stuart Staniford , and Vern Paxson.

---

Every month, critical vulnerabilities are reported on a wide variety of operating systems and applications. Computer virus attacks are quickly becoming the number one security problem which ranges between large scale social engineering attacks and exploiting critical vulnerabilities. Sophisticated attacks use polymorphism and even metamorphism mixed with cryptographically strong algorithms and self-updating which makes analysis and defense increasingly difficult.

This presentation will discuss the state of the art in computer viruses and computer virus defense. I will present some promising host-based prevention techniques that can stop entire classes of fast-spreading worms such W32/Sobig@mm and W32/Mydoom@mm as well as worms using buffer overflow attacks, such as Win32/CodeRed, Linux/Slapper, Win32/Slammer and Win32/Blaster. In-depth worm and exploit analysis are also discussed.

It is becoming increasingly important to find ways to bridge the gap between computer virus research and general security research. The primary goal of this presentation is to encourage the fight against computer viruses within the security community.

source: Fighting Computer Virus Attacks, Peter Szor, Chief Researcher, Symantec Corporation (an invited talk).

---

Viruses and other malicious programs are an ever-increasing threat to current computer systems. They can cause serious damage and consume countless hours of system administrators' time to combat. Most current virus scanners perform scanning only when a file is opened, closed, or executed. Such scanners are inefficient because they scan more data than is needed. Worse, scanning on close may detect a virus after it had already been written to stable storage, opening a window for the virus to spread before detection.

We developed Avfs, a true on-access anti-virus file system that incrementally scans files and prevents infected data from being committed to disk. Avfs is a stackable file system and therefore can add virus detection to any other file system: Ext3, NFS, etc. Avfs supports forensic modes that can prevent a virus from reaching the disk or automatically create versions of potentially infected files to allow safe recovery. Avfs can also quarantine infected files on disk and isolate them from user processes. Avfs is based on the open-source ClamAV scan engine, which we significantly enhanced for efficiency and scalability. Whereas ClamAV's performance degrades linearly with the number of signatures, our modified ClamAV scales logarithmically. Our Linux prototype demonstrates an overhead of less than 15% for normal user-like workloads.

source: Avfs: An On-Access Anti-Virus File System, Yevgeniy Miretskiy, Abhijith Das, Charles P. Wright, and Erez Zadok.

---

i expect to be there, i hope you will, too. this is where you get to see some of the more promising advancements in the industry take shape. if past leading indicators are any hint, expect to see this stuff become market-wide in the coming years.

distributed worm detection and characterization

a couple of papers crossed my desk recently that i think are impressive and worth looking at. these show part of the state of the art in worm detection. simple honeypots wont cut it any longer, you really need to dig through lots of data. a project i'm involved in (the IMS project) is seeking to do this as well, although our approach is somewhat different. hopefully we complement and don't compete too much with these other projects.

Monitoring any portion of the Internet address space reveals incessant activity. This holds even when monitoring traffic sent to unused addresses, which we term "background radiation." Background radiation reflects fundamentally nonproductive traffic, either malicious (flooding backscatter, scans for vulnerabilities, worms) or benign (misconfigurations). While the general presence of background radiation is well known to the network operator community, its nature has yet to be broadly characterized. We develop such a characterization based on data collected from four unused networks in the Internet. Two key elements of our methodology are (i) the use of filtering to reduce load on the measurement system, and (ii) the use of active responders to elicit further activity from scanners in order to differentiate different types of background radiation. We break down the components of background radiation by protocol, application, and often specific exploit; analyze temporal patterns and correlated activity; and assess variations across different networks and over time. While we find a menagerie of activity, probes from worms and autorooters heavily dominate. We conclude with considerations of how to incorporate our characterizations into monitoring and detection activities.

source: Characteristics of Internet Background Radiation, Ruoming Pang, Vinod Yegneswaran, Paul Barford, Vern Paxson, Larry Peterson.

---

Today's Internet intrusion detection systems (IDSes) monitor edge networks' DMZs to identify and/or filter malicious flows. While an IDS helps protect the hosts on its local edge network from compromise and denial of service, it cannot alone effectively intervene to halt and reverse the spreading of novel Internet worms. Generation of the worm signatures required by an IDS--the byte patterns sought in monitored traffic to identify worms--today entails non-trivial human labor, and thus significant delay: as network operators detect anomalous behavior, they communicate with one another and manually study packet traces to produce a worm signature. Yet intervention must occur early in an epidemic to halt a worm's spread. In this paper, we describe Autograph, a system that automatically generates signatures for novel Internet worms that propagate using TCP transport. Autograph generates signatures by analyzing the prevalence of portions of flow payloads, and thus uses no knowledge of protocol semantics above the TCP level. It is designed to produce signatures that exhibit high sensitivity (high true positives) and high specificity (low false positives); our evaluation of the system on real DMZ traces validates that it achieves these goals. We extend Autograph to share port scan reports among distributed monitor instances, and using trace-driven simulation, demonstrate the value of this technique in speeding the generation of signatures for novel worms. Our results elucidate the fundamental trade-off between early generation of signatures for novel worms and the specificity of these generated signatures.

source: Autograph: Toward Automated, Distributed Worm Signature Detection, Hyang-Ah Kim and Brad Karp.

---

in a nutshell this is getting to be a crowded space with lots of promise.

recent worm papers

i've been busy reading a lot of papers lately, or "url-spotting mode" as arrigo puts it. a couple of conferences to note coming up shortly, DSN 2004 and WEIS04. a few that caught my eyes are below ...

Worms represent a substantial economic threat to the U.S.computing infrastructure. An important question is how much damage might be caused, as this figure can serveas a guide to evaluating how much to spend on defenses. We construct a parameterized worst-case analysis basedon a simple damage model, combined with our understanding of what an attack could accomplish. Althoughour estimates are at best approximations, we speculate that a plausible worst-case worm could cause $50 billionor more in direct economic damage by attacking widely used services in Microsoft Windows and carrying a highlydestructive payload.

source: A Worst-Case Worm, Nicholas Weaver and Vern Paxson, International Computer Science Institute International Computer Science Institute, WEIS04.

---

Our society is highly dependent on network services such as the Web, email, and collaborative P2P enterpriseapplications. But what if such infrastructures were suddenly torn down? Both past incidents and research studies show that a well-engineered Internet worm can accomplish such a task in a fairly simple way and, most notably, ina matter of a few minutes. This clearly rules out the possibility of manually countering worm outbreaks. We present a testbed that operates on a cluster of computers and emulates very large networks for purposes of experimentation.A wide variety of worm properties can be studied and network topologies of interest constructed. A reactive control system, based on the Willow architecture, operates on top of the testbed and provides a monitor/analyze/respondapproach to deal with infections automatically. The logic driving the control system is synthesized from a formal specification, which is based on control rules that correlate sensor events. Details of our highly configurable testbed,the theory of operation of the Willow architecture, the features of the specification language, and various experimental performance results are presented.

source: An Automated Defense System to Counter Internet Worms, Riccardo Scandariato, John C. Knight, DSN 2004.

---

If we limit the contact rate of worm traffic, can we alleviate and ultimately contain Internet worms? This paper sets out to answer this question. Specifically, we are interested in analyzing different deployment strategies of rate control mechanisms and the effect thereof on suppressing the spread of worm code. We use both analytical models and simulation experiments. We find that rate control at individual hosts or edge routers yields a slowdown that is linear in the number of hosts (or routers) with the rate limiting filters. Limiting contact rate at the backbone routers, however, is substantially more effective -- it renders a slowdown comparable to deploying rate limiting filters at every individual host that is covered. This result holds true even when susceptible and infected hosts are patched and immunized dynamically. To provide context for our analysis, we examine real traffic traces obtained from a campus computing network. We observe that rate throttling could be enforced with minimal impact on legitimate communications. Two worms observed in the traces, however, would be significantly slowed down.

source: Dynamic Quarantine of Internet Worms, Cynthia Wong, Chenxi Wang, Dawn Song, Stan Bielski, Gregory R. Ganger, DSN 2004.