Automatically Deducing Propagation Sequences that Circumvent a Collaborative Worm Defense

Abstract

We present an approach to the question of evaluating worm defenses against future, yet unseen, and possibly defenseaware worm behavior. Our scheme employs model checking to produce worm propagation sequences that defeat a worm defense of interest. We demonstrate this approach using an exemplar collaborative worm defense, in which LANs share alerts about encountered infections. Through model checking experiments, we then generate propagation sequences that are able to infect the whole population in the modeled network. We discuss these experimental results and also identify open problems in applying formal methods more generally in the context of worm quarantine research.

COVERAGE: detecting and reacting to worm epidemics using cooperation and validation

“…Cheetancheri et al [14] experimentally investigate the parameters of a cooperating alert sharing protocol coupled with distributed sequential hypothesis testing to generate global alarms about distributed attacks. Briesenmeister and Porras [9] use formal methods and a model of collaborative worm defenses to create propagation strategies that prevent such defenses from reaching global consensus. They conclude that randomized algorithms offer one approach toward foiling this strategy, citing COVERAGE as a specific example.…”

“…We believe this to be an unavoidable consequence of their robustness against false alarms. Independent work [9] has pointed out that the randomized approach of COVER-AGE makes it difficult to devise virus propagation strategies that exploit the particular topology and exchange models of other collaborative virus defenses to hide their spread.…”

A PRoactive malware identification system based on the computer hygiene principles

“…Therefore, more applicable solutions utilizing multiple firewalls to contain rapid malcode in different segments of large Wide Area Networks (WAN) are already in use (Staniford, 2003). Briesemeister et al (Briesemeister & Porras, 2006;Briesemeister & Porras, 2005) have made significant contributions to the design of quarantine algorithms using game theoretic approaches and formal methods, though they did not disclose all the implementation details of a future system based on their work. On the other hand Keromytis et al present the COVERAGE algorithm, which takes most of the practical issues into account.…”