A spatial stochastic model for worm propagation: scale effects

Avlonitis, Markos; Magkos, Emmanouil; Stefanidakis, Michalis; Chrissikopoulos, Vassilios

doi:10.1007/s11416-007-0048-y

Cited by 11 publications

(16 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This section briefly describes the model proposed in [1]. Let N i be the number of susceptible hosts in the i-th subnet and I i the infected hosts in the same subnet.…”

Section: A Brief Review Of the Gradient Modelmentioning

confidence: 99%

“…Assuming a random scanning strategy, there is a probability P I N that a host inside the subnet targets a host inside the same subnet and a probability P OU T that instead it attacks another subnet. Following the line of [1], starting from a continuous evolution equation of the form,…”

Section: A Brief Review Of the Gradient Modelmentioning

confidence: 99%

“…Unfortunately, results based on ODEs do not describe the spatial behaviour of the worm propagation phenomena, and thus do not properly address scalability issues (e.g., an ODE model will fail to tell how infected a specific area in space becomes). In a recent model proposed in [1] the classical model was extended by incorporating spatial interactions between and within networks and an evolution equation for worm propagation into an arbitrary subnet was proposed. According to the formalism, the notion of a critical network size (hereinafter called a critical network) was also introduced.…”

Section: Introductionmentioning

confidence: 99%

“…In this work we elaborate on the recent gradient model of [1] by introducing an appropriate new term which models human intervention (i.e., preventive and/or reactive measures that mitigate the worm propagation), thus better approximating the real-world behaviour of scanning worms and of the host population in the Internet. Furthermore, we study the dynamics of the new model and give an emphasis to explaining the higher propagation rates of local-preference worm strategies (as observed in real measurements), compared with the propagation rates of random scanning worms.…”

Section: Introductionmentioning

confidence: 99%

“…In Sect. 4 we present a new model that incorporates human intervention in the model of [1], and analytically solve our equations. In Sect.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Treating scalability and modelling human countermeasures against local preference worms via gradient models

et al. 2008

Self Cite

View full text Add to dashboard Cite

A network worm is a specific type of malicious software that self propagates by exploiting application vulnerabilities in network-connected systems. Worm propagation models are mathematical models that attempt to capture the propagation dynamics of scanning worms as a means to understand their behaviour. It turns out that the emerged scalability in worm propagation plays an important role in order to describe the propagation in a realistic way. On the other hand human-based countermeasures also drastically affect the propagation in time and space. This work elaborates on a recent propagation model (Avlonitis et al. in J Comput Virol 3, 87-92, 2007) that makes use of Partial Differential Equations in order to treat correctly scalability and non-uniform behaviour (e.g., local preference worms). The aforementioned gradient model is extended in order to take into account human-based countermeasures that influence the propagation of local-preference worms in the Internet. Certain aspects of scalability emerged in random and local preference strategies are also discussed by means of random field considerations. As a result the size of a critical network that needs to be studied in order to describe the global propagation of a scanning worm is estimated. Finally, we present simulation results that validate the proposed analytical results and demonstrate the higher propagation rate of local preference worms compared with random scanning worms.

show abstract

“…This section briefly describes the model proposed in [1]. Let N i be the number of susceptible hosts in the i-th subnet and I i the infected hosts in the same subnet.…”

Section: A Brief Review Of the Gradient Modelmentioning

confidence: 99%

Section: A Brief Review Of the Gradient Modelmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…In Sect. 4 we present a new model that incorporates human intervention in the model of [1], and analytically solve our equations. In Sect.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Treating scalability and modelling human countermeasures against local preference worms via gradient models

et al. 2008

Self Cite

View full text Add to dashboard Cite

show abstract

Modeling and analysis of a self‐learning worm based on good point set scanning

Wang

Zhang

2008

Wireless Communications

View full text Add to dashboard Cite

Internet worms can self‐propagate over the Internet, and have caused significant damages to the Internet infrastructure. To speed up the propagating process, the worms need to scan many Internet Protocol (IP) addresses to target vulnerable hosts. However, the distribution of IP addresses is highly non‐uniform, which results in many scans wasted on invulnerable addresses. Inspired by the theory of good point set, this paper proposes a new scanning strategy, referred to as good point set scanning (GPSS), for worms. Experimental results show that GPSS can generate more distinct IP addresses and less unused IP addresses than the permutation scanning. Combined with group distribution, a static optimal GPSS is derived. Since the information cannot be easily collected before a worm is released, a self‐learning worm with GPSS is designed. Such worm can accurately estimate the underlying vulnerable‐host distribution when a sufficient number of IP addresses of infected hosts are collected. We use a modified Analytical Active Worm Propagation (AAWP) to simulate data of Code Red and the performance of different scanning strategies. Experimental results show that once the distribution of vulnerable hosts is accurately estimated, a self‐learning worm can propagate much faster than other worms. Finally, some possible countermeasures are given. Copyright © 2008 John Wiley & Sons, Ltd.

show abstract