A network telescope perspective of the Conficker outbreak

Irwin, Barry

doi:10.1109/issa.2012.6320455

Cited by 5 publications

(2 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• Neighbourhood spreading, where it probes computers in ten neighbouring LANs (with smaller consecutive IP address prefixes). Previous research on Conficker has studied the geographical distribution of infected IP addresses, the distribution of probing packet size [7,54,55], and properties of the worm's global probing [56,57]. The parameters of Conficker's hybrid spreading and how they affect the epidemic dynamics of the worm can help explain why the worm is so contagious.…”

Section: Computer Worm Confickermentioning

confidence: 99%

Hybrid Epidemics—A Case Study on Computer Worm Conficker

2015

View full text Add to dashboard Cite

Conficker is a computer worm that erupted on the Internet in 2008. It is unique in combining three different spreading strategies: local probing, neighbourhood probing, and global probing. We propose a mathematical model that combines three modes of spreading: local, neighbourhood, and global, to capture the worm’s spreading behaviour. The parameters of the model are inferred directly from network data obtained during the first day of the Conficker epidemic. The model is then used to explore the tradeoff between spreading modes in determining the worm’s effectiveness. Our results show that the Conficker epidemic is an example of a critically hybrid epidemic, in which the different modes of spreading in isolation do not lead to successful epidemics. Such hybrid spreading strategies may be used beneficially to provide the most effective strategies for promulgating information across a large population. When used maliciously, however, they can present a dangerous challenge to current internet security protocols.

show abstract

Section: Computer Worm Confickermentioning

confidence: 99%

Hybrid Epidemics—A Case Study on Computer Worm Conficker

2015

View full text Add to dashboard Cite

show abstract

“…[12]. For example a /24 network telescope was used for Conficker analysis, where the research team [13] analyzed dataset of some 16 million packets targeting port 445/tcp in South African IP address space. This is followed by a detailed analysis of the packet characteristics observed, including size and TTL and intricacies of observed target selection and the flaw in the Conficker worm's propagation algorithm.…”

Section: Darknets Aka Network Telescopesmentioning

confidence: 99%

Attention

Basam

Marchany

Tront

2015

Proceedings of the 12th ACM International Conference on Computing Frontiers

View full text Add to dashboard Cite

The immense address space available with the new 128-bit addressing scheme enables mechanisms like Moving Target Defense for IPv6 networks. Moving Target IPv6 Defense (MT6D) promises security by letting nodes hop to new addresses that are cryptographically computed between involved nodes without disrupting ongoing conversations. After implementing MT6D as a testbed for previous research project, we asked ourselves if it is worth looking at the old addresses that are being given up by MT6D nodes and purged in the process. We explored the idea if activity on these relinquished addresses holds any vital clues for verifying and reinforcing the security of MT6D networks. During the analysis, we realized the need for a method to ensure the resiliency of the scheme besides uncovering any attacks that are underway. In this paper, we will discuss a novel solution that comprises of learning addresses that are being relinquished by the MT6D nodes, acquiring these addresses, performing traffic enumeration on these addresses and visualizing the same. We can become cognizant of a trailing attacker following a MT6D node along the address changes, besides uncovering any suspicious traffic hitting the MT6D nodes with this solution in place.

show abstract