The detection of RCS worm epidemics

ABSTRACT

This paper discusses the problem of automatically detecting the existence of Random Constant Scanning (RCS) worm epidemics on the Internet by observing packet traffic in a local network. The propagation of the RCS worm is modelled as a simple epidemic. An optimal hypothesis-testing approach is presented to detect simple epidemics under idealized conditions based on the cumulative sums of log-likelihood ratios. It is shown that there are limitations on the ability of this optimal method to detect several important subclasses of RCS worm epidemics even under idealized conditions.

REFERENCES

• 1: H. Andersson and T. Britton. Stochastic Epidemic Models and Their Statistical Analysis. Number 151 in Lecture Notes in Statistics. Springer-Verlag, 2000.
• 2: Michèle Basseville , Igor V. Nikiforov, Detection of abrupt changes: theory and application, Prentice-Hall, Inc., Upper Saddle River, NJ, 1993
• 3: F. Brauer and C. Castillo-Chávez. Mathematical Models in Population Biology and Epidemiology. Number 40 in Texts in Applied Mathematics. Springer-Verlag, New York, 2001.
• 4: D. Daley and J. Gani. Epidemic Modelling: An Introduction. Cambridge University Press, 1999.
• 5: Herbert W. Hethcote, The Mathematics of Infectious Diseases, SIAM Review, v.42 n.4, p.599-653, Dec. 2000 [doi>10.1137/S0036144500371907]
• 6: J. Jung, V. Paxson, A. W. Berger, and H. Balakrishnan. Fast portscan detection using sequential hypothesis testing. In Proc. of the IEEE Symposium on Security and Privacy, 2004.
• 7: David Moore , Vern Paxson , Stefan Savage , Colleen Shannon , Stuart Staniford , Nicholas Weaver, Inside the Slammer Worm, IEEE Security and Privacy, v.1 n.4, p.33-39, July 2003 [doi>10.1109/MSECP.2003.1219056]
• 8: David Moore , Colleen Shannon , k claffy, Code-Red: a case study on the spread and victims of an internet worm, Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, November 06-08, 2002, Marseille, France [doi>10.1145/637201.637244]
• 9: Ruoming Pang , Vinod Yegneswaran , Paul Barford , Vern Paxson , Larry Peterson, Characteristics of internet background radiation, Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, October 25-27, 2004, Taormina, Sicily, Italy [doi>10.1145/1028788.1028794]
• 10: H. Vincent Poor, An introduction to signal detection and estimation (2nd ed.), Springer-Verlag New York, Inc., New York, NY, 1994
• 11: K. Rohloff and T. Başsar. Stochastic behavior of random constant scanning worms. In Proc. of 14th ICCCN, 2005.
• 12: S. E. Schechter, J. Jung, and A. W. Berger. Fast detection of scanning worm infections. In Proc. of The Seventh International Symposium on Recent Advances in Intrusion Detection (RAID), 2004.
• 13: Stuart Staniford , Vern Paxson , Nicholas Weaver, How to Own the Internet in Your Spare Time, Proceedings of the 11th USENIX Security Symposium, p.149-167, August 05-09, 2002
• 14: A. Wald. Sequential Analysis. Dover, New York, 1947.
• 15: N. Weaver, S. Staniford, and V. Paxson. Very fast containment of scanning worms. In Proc. of the 13th USENIX Security Symposium (Security '04), 2004.
• 16: Cliff Changchun Zou , Lixin Gao , Weibo Gong , Don Towsley, Monitoring and early warning for internet worms, Proceedings of the 10th ACM conference on Computer and communications security, October 27-30, 2003, Washington D.C., USA [doi>10.1145/948109.948136]

INDEX TERMS

Primary Classification:
  G. Mathematics of Computing
  G.3 PROBABILITY AND STATISTICS
      Subjects: Stochastic processes

Additional Classification:
  G. Mathematics of Computing
  G.3 PROBABILITY AND STATISTICS
      Subjects: Time series analysis

General Terms:
Experimentation, Security, Theory