A drawback of current anti-virus simulations: the need for background traffic

ABSTRACT

Although the most basic simulations of worm spread require the simulation of only the traffic generated by the malcode, when modeling the effects of antiworm techniques the results can be misleading if the background traffic is not taken into consideration. Despite the need for background traffic, no anti-worm simulation to date incorporates general traffic in the model.In this work I introduce a simple model of background traffic generation for arbitrary size networks. My approach builds on a traffic generation model for security testing and is validated against the predictions of the base model.

REFERENCES

• 1: Spyros Antonatos , Kostas G. Anagnostakis , Evangelos P. Markatos, Generating realistic workloads for network intrusion detection systems, Proceedings of the 4th international workshop on Software and performance, January 14-16, 2004, Redwood Shores, California
• 2: Paul Barford , Mark Crovella, Generating representative Web workloads for network and server performance evaluation, Proceedings of the 1998 ACM SIGMETRICS joint international conference on Measurement and modeling of computer systems, p.151-160, June 22-26, 1998, Madison, Wisconsin, United States
• 3: Cao, J., Cleveland, W. S., Gao, Y., Jeffay, K., Smith, F. D., and Weigle, M. Stochastic Models for Generating Synthetic HTTP Source Traffic. In Proceedings of the Conference on Computer Communications (IEEE INFOCOM) (Hong Kong, China, Mar. 7-11, 2004).
• 4: James H. Cowie , David M. Nicol , Andy T. Ogielski, Modeling the Global Internet, Computing in Science and Engineering, v.1 n.1, p.42-50, January 1999 [doi>10.1109/5992.743621]
• 5: Kim, H.-A. and Karp, B. Autograph: Toward Automated, Distributed Worm Signature Detection. In Proceedings of the 13th USENIX Security Symposium. USENIX, (Aug. 2004).
• 6: Michael Liljenstam , David M. Nicol , Vincent H. Berk , Robert S. Gray, Simulating realistic network worm traffic for worm warning system design and testing, Proceedings of the 2003 ACM workshop on Rapid malcode, October 27-27, 2003, Washington, DC, USA [doi>10.1145/948187.948193]
• 7: Song Luo , Gerald A. Marin, Creating models of internet background traffic suitable for use in evaluating network intrusion detection systems, University of Central Florida, Orlando, FL, 2005
• 8: Bruce A. Mah, An Empirical Model of HTTP Network Traffic, Proceedings of the INFOCOM '97. Sixteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Driving the Information Revolution, p.592, April 09-11, 1997
• 9: James Newsome , Brad Karp , Dawn Song, Polygraph: Automatically Generating Signatures for Polymorphic Worms, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.226-241, May 08-11, 2005 [doi>10.1109/SP.2005.15]
• 10: George F. Riley, The Georgia Tech Network Simulator, Proceedings of the ACM SIGCOMM workshop on Models, methods and tools for reproducible network research, August 25-27, 2003, Karlsruhe, Germany [doi>10.1145/944773.944775]
• 11: Williamson, M. M. An Epidemiological Model of Virus Spread and Cleanup. In Proceedings of Virus Bulletin (VB2003) (Toronto, Canada, Sept. 25-26, 2003).
• 12: Yuksel, M., Sikdar, B., Vastola, K. S., and Szymanski, B. Workload Generation for ns Simulations of Wide Area Networks and the Internet. In Proceedings of Communication Networks and Distributed Systems Modeling and Simulation Conference, (San Diego, CA, 2000), 93--98.
• 13: Cliff Changchun Zou , Weibo Gong , Don Towsley, Worm propagation modeling and analysis under dynamic quarantine defense, Proceedings of the 2003 ACM workshop on Rapid malcode, October 27-27, 2003, Washington, DC, USA [doi>10.1145/948187.948197]

INDEX TERMS

Primary Classification:
  I. Computing Methodologies
  I.6 SIMULATION AND MODELING
      I.6.5 Model Development

General Terms:
Design, Experimentation, Security

Keywords:
background traffic, virus-spread simulation