Introduction to Internet Worm Cliff C Zou CAP

Introduction to Internet Worm Cliff C. Zou CAP 6133, Spring’ 08 1

Common forms of malware u “Malware” --- malicious software n Viruses n Worms n Trojan horses u Appear to be good but perform malicious actions n Spyware, adware n Email spam, phishing 2

What is an Internet worm? n A code that replicates itself over a computer network on its own and usually performs malicious actions u Exploit a vulnerability in some remote computers Ø u u u OS, installed software has the vulnerability Runs on compromised computers without permission from their users Jump from one computer to another through the Internet Automatic spreading without any human intervention Ø Basic difference from “viruses” 3

Worm propagation process Find new targets n u u n IP random scanning Send TCP/SYN or UDP packet Compromise targets u n Exploit vulnerability Newly infected join infection army 4

Worm research motivation n Code Red (Jul. 2001) : 360, 000 infected in 14 hours n Slammer (Jan. 2003) : 75, 000 infected in 10 minutes Congested parts of Internet (ATMs down…) n Blaster (Aug. 2003) : 150, 000 ~ 8 million infected DDOS attack (shut down domain windowsupdate. com) n Witty (Mar. 2004) : 12, 000 infected in half an hour Attack vulnerability in ISS security products n Sasser (May 2004) : 500, 000 infected within two days Infection faster than human response ! 5

How to defend against Internet worm attack? n Automatic response required n First, understanding worm behavior u u n Next, worm detection u u n Basis for worm detection/defense Similar to epidemic spreading Automatic (catch worm speed) Unknown worm (no known signature) Last, must have autonomous defense u u False alarm? More advanced worm? (e. g. , polymorphic worm) 6

Internet Worm Modeling n Internet worm propagation is similar to epidemic spreading Borrow models from epidemiology area u Modify models based on worm’s behaviors u n Simple epidemic model: It: # of infected N: # of total population 7

Simple worm propagation model n address space, size W n N : total vulnerable n It : infected by time t u n W N-It vulnerable at time t scan rate (per host), h Prob. of a scan hitting vulnerable # of increased infected in a unit time 8

Worm modeling papers references n “How to own the Internet in your spear time” u n “On the Performance of Internet Worm Scanning Strategies” u n Modeling worm when it uses different scanning methods “Models of Active Worm Defenses” u n First modeling paper after Code Red (most important paper) Modeling good worm defense against bad worm ” Modeling the Spread of Active Worms” u Modeling based on discrete-time equations 9

Internet worm detection n Detection of unknown worm u n No signature is known before a worm’s break out Different forms of worm detection u Detect a worm’s breakout in the Internet Ø u Detect infected hosts in the global Internet Ø u Help filtering, protect local networks Detect local infected hosts Ø u Minimum, does not provide further information Help maintenance; stop major damage before too late Automatic signature generation Ø Most valuable; directly help worm filtering 10

Worm detection papers references n “Monitoring and Early Warning for Internet Worms” n “Fast Portscan Detection Using Sequential Hypothesis Testing” n n n “Cooperative Response Strategies for Large Scale Attack Mitigation” “Automated Worm Fingerprinting” Host-based, network traffic-based worm detection systems u Will be introduced in later topics 11

Internet worm defense n Can catch a worm’s rapid speed? u u n Automatic, quick enough “Internet Quarantine: Requirements for Containing Self. Propagating Code” Acceptable false alarm cost? u u u Major reason for slow deployment of automatic worm defense systems People tend to forget worms until hit hard “Throttling Viruses: Restricting Propagation to Defeat Mobile Malicious Code” 12

Advanced worms Polymorphic worms n A hot topic in current research community n Worm changes its code as it spreads out u u n n Use encryption to hide code signature Use code transformation technique for change Make it harder to automatically generate signature Two papers (attack/defense): u u “Advanced Polymorphic Worms: Evading IDS by Blending in with Normal Traffic” “Polygraph: Automatic Signature Generation for Polymorphic Worms” 13