Title

On The Performance Of Internet Worm Scanning Strategies

Keywords

Network monitoring; Network security; Worm modeling; Worm scanning strategy

Abstract

In recent years, fast spreading worms, such as Code Red, Slammer, Blaster and Sasser, have become one of the major threats to the security of the Internet. In order to defend against future worms, it is important to first understand how worms propagate and how different scanning strategies affect worm propagation dynamics. In this paper, we systematically model and analyze worm propagation under various scanning strategies, such as uniform scan, routing scan, hit-list scan, cooperative scan, local preference scan, sequential scan, divide-and-conquer scan, target scan, etc. We also provide an analytical model to accurately model Witty worm's destructive behavior. By using the same modeling framework, we reveal the underlying similarity and relationship between different worm scanning strategies. In addition, based on our simulation and analysis of Blaster worm propagation and monitoring, we provide a guideline for building a better worm monitoring infrastructure. © 2005 Elsevier B.V. All rights reserved.

Publication Date

7-1-2006

Publication Title

Performance Evaluation

Volume

63

Issue

7

Number of Pages

700-723

Document Type

Article

Personal Identifier

scopus

DOI Link

https://doi.org/10.1016/j.peva.2005.07.032

Socpus ID

33646150900 (Scopus)

Source API URL

https://api.elsevier.com/content/abstract/scopus_id/33646150900

This document is currently not available here.

Share

COinS