MAISim: mobile agent malware simulator

ABSTRACT

One of the problems related to the simulation of attacks against critical infrastructures is the lack of adequate tools for the simulation of malicious software (malware). Malware attacks are the most frequent in the Internet and they pose a serious threat against critical networked infrastructures. To address this issue we developed Mobile Agent Malware Simulator (MAISim). The framework uses the technology of mobile agents and it aims at simulation of various types of malicious software (viruses, worms, malicious mobile code). Moreover it can be flexibly deployed over computer network of an arbitrary information system.

REFERENCES

• 1: Federal Office for Information Security (BSI). BSI annual report 2003. Internet, 2003. Available at http://www.bsi.bund.de/english/publications/annualreport/index.htm (last access: October 30, 2007).
• 2: Janusz Górski, Aleksander Jarzȩbowicz, Rafał Leszczyna, Jakub Miler, and Marcin Olszewski. Trust case: justifying trust in an it solution. In Proceedings of Safecomp Conference, Reliability Engineering and System Safety, volume 89, pages 33--47. Elsevier, July 2005.
• 3: Ed Skoudis , Lenny Zeltser, Malware: Fighting Malicious Code, Prentice Hall PTR, Upper Saddle River, NJ, 2003
• 4: Sarah Gordon. Are good virus simulators still a bad idea? Network Security, 1996(9):7--13, September 1996.
• 5: Joe Hirst. Virus simulation suite. Internet, 1990.
• 6: Thomas Faistenhammer, Martin Klöck, Karlhorst Klotz, Thomas Krüger, Peter Reinisch, and Jenny Wagner. Virlab 2.1. Internet, October 1993. Available at http://kklotz.de/html/virlab.html (last access: October 29, 2007).
• 7: Rosenthal Engineering. Rosenthal virus simulator. Internet, 1997.
• 8: Monirul I. Sharif , George F. Riley , Wenke Lee, Comparative Study between Analytical Models and Packet-Level Worm Simulations, Proceedings of the 19th Workshop on Principles of Advanced and Distributed Simulation, p.88-98, June 01-03, 2005 [doi>10.1109/PADS.2005.5]
• 9: Symantec Research Labs. Symantec worm simulator. Internet, 2005.
• 10: Dan Ellis, Worm anatomy and model, Proceedings of the 2003 ACM workshop on Rapid malcode, October 27-27, 2003, Washington, DC, USA [doi>10.1145/948187.948196]
• 11: Cliff Changchun Zou , Weibo Gong , Don Towsley, Worm propagation modeling and analysis under dynamic quarantine defense, Proceedings of the 2003 ACM workshop on Rapid malcode, October 27-27, 2003, Washington, DC, USA [doi>10.1145/948187.948197]
• 12: M. Liljenstam , Y. Yuan , B. J. Premore , D. Nicol, A Mixed Abstraction Level Simulation Model of Large-Scale Internet Worm Infestations, Proceedings of the 10th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunications Systems (MASCOTS'02), p.109, October 11-16, 2002
• 13: Michael Liljenstam , David M. Nicol , Vincent H. Berk , Robert S. Gray, Simulating realistic network worm traffic for worm warning system design and testing, Proceedings of the 2003 ACM workshop on Rapid malcode, October 27-27, 2003, Washington, DC, USA [doi>10.1145/948187.948193]
• 14: Arno Wagner , Thomas Dübendorfer , Bernhard Plattner , Roman Hiestand, Experiences with worm propagation simulations, Proceedings of the 2003 ACM workshop on Rapid malcode, October 27-27, 2003, Washington, DC, USA [doi>10.1145/948187.948194]
• 15: David Moore, Colleen Shannon, Geoffrey M. Voelker, and Stefan Savage. Internet quarantine: Requirements for containing self-propagating code. In INFOCOM 2003. Twenty-Second Annual Joint Conference of the IEEE Computer and Communications Societies. IEEE, volume 3, pages 1901--1910, April 2003.
• 16: Kalyan S. Perumalla , Srikanth Sundaragopalan, High-Fidelity Modeling of Computer Network Worms, Proceedings of the 20th Annual Computer Security Applications Conference, p.126-135, December 06-10, 2004 [doi>10.1109/CSAC.2004.21]
• 17: Songjie Wei , Jelena Mirkovic , Martin Swany, Distributed Worm Simulation with a Realistic Internet Model, Proceedings of the 19th Workshop on Principles of Advanced and Distributed Simulation, p.71-79, June 01-03, 2005 [doi>10.1109/PADS.2005.7]
• 18: Songjie Wei , Jelena Mirkovic, A realistic simulation of internet-scale events, Proceedings of the 1st international conference on Performance evaluation methodolgies and tools, October 11-13, 2006, Pisa, Italy [doi>10.1145/1190095.1190131]
• 19: Mischel Internet Security. Trojan simulator. Internet, 2003. Available at http://www.misec.net/trojansimulator/ (last access: October 29, 2007).
• 20: Fabio Bellifemine, Giovanni Caire, Tiziana Trucco, and Giovanni Rimassa. JADE - A White Paper, September 2003.
• 21: David Chess, Colin Harrison, and Aaron Kershenbaum. Mobile agents: Are they a good idea? Technical Report RC 19887 (December 21, 1994 -Declassified March 16, 1995), IBM Research, Yorktown Heights, New York, 1994. Available at citeseer.ist.psu.edu/chess95mobile.html.
• 22: Davis Chess, Benjamin Grosof, Colin Harrison, David Levine, Colin Parris, and Gene Tsudik. Itinerant agents for mobile computing. IEEE Personal Communications, 2(5):34--49, 1995. Available at citeseer.ist.psu.edu/article/chess95itinerant. html.
• 23: Stan Franklin , Art Graesser, Is it an Agent, or Just a Program?: A Taxonomy for Autonomous Agents, Proceedings of the Workshop on Intelligent Agents III, Agent Theories, Architectures, and Languages, p.21-35, August 12-13, 1996
• 24: Antonio Carzaniga , Gian Pietro Picco , Giovanni Vigna, Designing distributed applications with mobile code paradigms, Proceedings of the 19th international conference on Software engineering, p.22-32, May 17-23, 1997, Boston, Massachusetts, United States [doi>10.1145/253228.253236]
• 25: Alfonso Fuggetta , Gian Pietro Picco , Giovanni Vigna, Understanding Code Mobility, IEEE Transactions on Software Engineering, v.24 n.5, p.342-361, May 1998 [doi>10.1109/32.685258]
• 26: Deja Milojicic, Mobile Agent Applications, IEEE Concurrency, v.7 n.3, p.80-90, July 1999 [doi>10.1109/MCC.1999.788786]
• 27: Bennet S. Yee. A sanctuary for mobile agents. In Proceedings of the DARPA Workshop on Foundations for Secure Mobile Code, Monterey, USA, March 1997. Available at citeseer.ist.psu.edu/article/yee97sanctuary.html (last access: May 08, 2006).
• 28: Robert S. Gray , David Kotz , George Cybenko , Daniela Rus, Mobile Agents: Motivations and State-of-the-Art Systems, Dartmouth College, Hanover, NH, 2000
• 29: W. Jansen and T. Karygiannis. Nist special publication 800--19 - mobile agent security, 2000. Available at citeseer.ist.psu.edu/jansen00nist.html.
• 30: Telecom Italia Lab. Java Agent DEvelopment Framework. Website, http://jade.tilab.com/.
• 31: Giovanni Caire. JADE tutorial: application-defined content languages and ontologies, June 2002.
• 32: Rafał Leszczyna. Evaluation of agent platforms. Technical report, European Commission, Joint Research Centre, Institute for the Protection and security of the Citizen, Ispra, Italy, June 2004.
• 33: Fabio Bellifemine, Giovanni Caire, Tiziana Trucco, and Giovanni Rimassa. Jade programmeršs guide, February 2003.
• 34: Marcelo Masera and Igor Nai Fovino. A service oriented approach to the assessment of infrastructure security. In First Annual IFIP Working Group 11.10 International Conference on Critical Infrastructure Protection, volume 1, March 2007.
• 35: Marcelo Masera Igor Nai Fovino and Alessio Decian. Integration of cyber-attack within fault trees. In 17th European Safety and Reliability Conference (ESREL), volume 3, pages 2571--2578, June 2007.
• 36: Rafał Leszczyna, Igor Nai Fovino, and Marcelo Masera. Security evaluation of it systems underlying critical networked infrastructures. Accepted for First International IEEE Conference on Information Technology (IT 2008), Gdansk, Poland, 18--21 May 2008, May 2008.

INDEX TERMS

Primary Classification:
  I. Computing Methodologies
  I.6 SIMULATION AND MODELING
      I.6.7 Simulation Support Systems

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General

  I. Computing Methodologies
  I.2 ARTIFICIAL INTELLIGENCE
        I.2.11 Distributed Artificial Intelligence

General Terms:
Performance, Security

Keywords:
ACM proceedings, computer attacks, critical infrastructures, malware, mobile agents, security, simulation