Modeling and Defending Against Internet Worm Attacks

As computer and communication networks become prevalent, the Internet has been a battlefield for attackers and defenders. One of the most powerful weapons for attackers is the Internet worm. Specifically, a worm attacks vulnerable computer systems and employs self-propagating methods to flood the Internet rapidly. The objective of this research is to characterize worm attack behaviors, analyze Internet vulnerabilities, and develop effective countermeasures. More specifically, some fundamental factors that enable a worm to be designed with advanced scanning methods are presented and investigated through mathematical modeling, simulations, and real measurements. First, one factor is an uneven vulnerable-host distribution that leads to an optimal scanning method called importance scanning. Such a new method is developed from and named after importance sampling in statistics and enables a worm to spread much faster than both random and routable scanning. The information of vulnerable-host distributions, however, may not be known before a worm is released. To overcome this, worms using two sub-optimal methods are then investigated. One is a self-learning worm that can accurately estimate the underlying vulnerable-host distribution while propagating. The other is a localized-scanning worm that has been exploited by Code Red II and Nimda worms. The optimal localized scanning and three variants of localized scanning are also studied. To fight against importance-scanning, self-learning, and localized-scanning worms, defenders should scatter applications uniformly in the entire IP-address space from the viewpoint of game theory. Next, a new metric, referred to as the non-uniformity factor, is presented to quantify both the unevenness of a vulnerable-host distribution and the spreading ability of network-aware worms. This metric is essentially the Renyi information entropy and better characterizes the non-uniformity of a distribution than the Shannon entropy. Finally, another fundamental factor is topology information that enables topological-scanning worms. The spreading dynamics of topological-scanning worms are modeled through a spatial-temporal random process and simulated with both real and synthesized topologies.Ph.D.Committee Chair: Ji, Chuanyi; Committee Member: Ammar, Mostafa; Committee Member: Copeland, John; Committee Member: Lee, Wenke; Committee Member: Riley, Georg