Take a look at the new version of this page: [ beta version ]. Tell us what you think.

ABSTRACT

Random-scanning worms can be adapted, without a complex overlay control network, to stop their scanning activity once a certain percentage of all vulnerable hosts have been infected. This modification makes a worm more difficult to detect for a defender. This paper examines the theoretical concept of a perfect self-stopping algorithm, and discusses some of the limitations of Ma et al.'s Sum-Count-X self-stopping mechanism [7]. An alternative self-stopping mechanism based on the bacterial mechanism of quorum sensing [4] is suggested, and its feasibility is explored via simulation. Possible counter-measures to this new mechanism are also discussed

REFERENCES

• 1: Michael Bailey , Evan Cooke , Farnam Jahanian , David Watson , Jose Nazario, The Blaster Worm: Then and Now, IEEE Security and Privacy, v.3 n.4, p.26-31, July 2005 [doi>10.1109/MSP.2005.106]
• 2: Francesco Bernardini , Marian Gheorghe , Natalio Krasnogor, Quorum sensing P systems, Theoretical Computer Science, v.371 n.1-2, p.20-33, February, 2007 [doi>10.1016/j.tcs.2006.10.012]
• 3: M. Dorigo, V. Maniezzo, and A. Colorni. Ant system: Optimization by a colony of cooperating agents. IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics, 26(1):29--41, February 1996.
• 4: J. M. Henke and B. L. Bassler. Bacterial social engagements. TRENDS in Cell Biology, 14(11):648--656, November 2004.
• 5: J. Kennedy and R. Eberhart. Particle swarm optimization. In Proceedings of the IEEE Conference on Neural Networks, pages 1942--1948, 1995.
• 6: J. Ma. Private e-mail communication, 17 November 2006.
• 7: Justin Ma , Geoffrey M. Voelker , Stefan Savage, Self-stopping worms, Proceedings of the 2005 ACM workshop on Rapid malcode, November 11-11, 2005, Fairfax, VA, USA [doi>10.1145/1103626.1103630]
• 8: D. L. Milton. Quorum sensing in vibrios: Complexity for diversification. Int. J. Med. Microbiol., 296(2--3):61--71, April 2006.
• 9: David Moore , Vern Paxson , Stefan Savage , Colleen Shannon , Stuart Staniford , Nicholas Weaver, Inside the Slammer Worm, IEEE Security and Privacy, v.1 n.4, p.33-39, July 2003 [doi>10.1109/MSECP.2003.1219056]
• 10: J. P. Pearson, L. Passador, B. H. Iglewski, and E. P. Greenberg. A second N-acylhomoserine lactone signal produced by Pseudomonas aeruginosa. Proc. Natl. Acad. Sci. USA, 92(5):1490--1494, February 1995.
• 11: Maxim Peysakhov , Christopher Dugan , Pragnesh Jay Modi , William Regli, Quorum sensing on mobile ad-hoc networks, Proceedings of the fifth international joint conference on Autonomous agents and multiagent systems, May 08-12, 2006, Hakodate, Japan [doi>10.1145/1160633.1160831]
• 12: J. Stone. Detecting and recovering from a virus incident. Symantec Advantage, Summer 2003. http://www.symantec.com/symadvantage/019/recover.html.
• 13: Jamie Twycross , Matthew M. Williamson, Implementing and testing a virus throttle, Proceedings of the 12th conference on USENIX Security Symposium, p.20-20, August 04-08, 2003, Washington, DC
• 14: R. Vogt, J. Aycock, and M. Jacobson, Jr. Army of botnets. In Proceedings of the 2007 Network and Distributed System Security Symposium, pages 111--123, 2007.
• 15: B. Wiley. Curious Yellow: The first coordinated worm design. http://blanu.net/curious_yellow, last accessed 21 September 2006.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

  I. Computing Methodologies
  I.6 SIMULATION AND MODELING
      I.6.8 Types of Simulation
          Subjects: Discrete event

General Terms:
Algorithms, Security

Keywords:
malware, quorum sensing, self-stopping algorithms, worms