TY - GEN
T1 - Analysis of the propagation pattern of a worm with random scanning strategy based on usage rate of network bandwidth
AU - Ko, Kwang Sun
AU - Jang, Hyunsu
AU - Park, Byuong Woon
AU - Eom, Young Ik
PY - 2010
Y1 - 2010
N2 - There have been many studies on modeling the propagation patterns of Internet worms since the advent of Morris worm. Among them, there is a well defined propagation model, which is generally called random constant spread (RCS) model. However, there are some limitations to model the propagation patterns of new emergent Internet worms with the RCS model because the model uses the only number of infected hosts as the factor of a worm's propagation. The new worms have several considerable characteristics: utilization of a faster scanning strategy, miniaturization of the size of a worm's propagation packet, denial of service by network saturation, and maximum damage before human-mediated responses. These characteristics make it difficult to notice much harder than before whether a worm propagates itself or not. Therefore, a basic factor instead of the number of infected hosts, which is used by the RCS model, is required to model the propagation patterns of new worms. In this paper, only analysis and simulation results based on usage rate of network bandwidth, which can be considered as a basic factor, are presented about the propagation pattern of a worm with random scanning strategy. Miniaturization of the size of a propagation packet and utilization of a faster scanning strategy are related to the size of worm's propagation packet and its propagation rate, respectively. It is presented that the latter is more sensitive than the former.
AB - There have been many studies on modeling the propagation patterns of Internet worms since the advent of Morris worm. Among them, there is a well defined propagation model, which is generally called random constant spread (RCS) model. However, there are some limitations to model the propagation patterns of new emergent Internet worms with the RCS model because the model uses the only number of infected hosts as the factor of a worm's propagation. The new worms have several considerable characteristics: utilization of a faster scanning strategy, miniaturization of the size of a worm's propagation packet, denial of service by network saturation, and maximum damage before human-mediated responses. These characteristics make it difficult to notice much harder than before whether a worm propagates itself or not. Therefore, a basic factor instead of the number of infected hosts, which is used by the RCS model, is required to model the propagation patterns of new worms. In this paper, only analysis and simulation results based on usage rate of network bandwidth, which can be considered as a basic factor, are presented about the propagation pattern of a worm with random scanning strategy. Miniaturization of the size of a propagation packet and utilization of a faster scanning strategy are related to the size of worm's propagation packet and its propagation rate, respectively. It is presented that the latter is more sensitive than the former.
KW - Propagation pattern of a worm
KW - random scanning strategy
KW - usage rate of network bandwidth
UR - https://www.scopus.com/pages/publications/77954567257
U2 - 10.1007/978-3-642-14423-3_25
DO - 10.1007/978-3-642-14423-3_25
M3 - Conference contribution
AN - SCOPUS:77954567257
SN - 3642144225
SN - 9783642144226
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 374
EP - 385
BT - Information Security and Cryptology - ICISC 2009 - 12th International Conference, Revised Selected Papers
T2 - 12th International Conference on Information Security and Cryptology, ICISC 2009
Y2 - 2 December 2009 through 4 December 2009
ER -