Monitoring and Early Warning for Internet Worms Cliff

Monitoring and Early Warning for Internet Worms Cliff C. Zou, Lixin Gao, Weibo Gong, Don Towsley Univ. Massachusetts, Amherst 1

How to detect an unknown worm at its early stage? n Monitoring: u Monitor worm scan traffic (non-legitimate traffic). Ø Ø u Observation data is very noisy Ø Ø n Connections to nonexistent IP addresses. Connections to unused ports. Old worms’ scans. Port scans by hacking toolkits. Detecting: u u Anomaly detection for unknown worms Traditional anomaly detection: threshold-based Ø Ø Check traffic burst (short-term or long-term). Difficulties: False alarms; threshold tuning. 2

“Trend Detection” Detect traffic trend, not burst Trend: worm exponential growth trend at the beginning Detection: the exponential rate should be a positive, constant value Monitored illegitimate traffic rate Exponential rate a on-line estimation Non-worm traffic burst Worm traffic 3

Why exponential growth at the beginning? n n The law of natural growth reproduction Exponential growth — fastest growth pattern when: u u u n Negligible interference (beginning phase). All objects have similar reproductive capability. Large-scale system — law of large number. Fast worm has exponential growth pattern u u u Attacker’s incentive: infect as many as possible before counteractions. If not, a worm does not reach its spreading speed limit. Slow spreading worms can be detected by other ways. 4

Worm modeling — simple epidemic model : # of susceptible : # of infectious : Total # of hosts : Infectious ability # of contacts I S Simple epidemic model: It Discrete model: with exponential rate At very early stage: 5

Why use simple epidemic model? n n Can model most scan-based worms. We can use other worm models as well with minor modifications (such as exponential model). Code Red SQL Slammer Figures from: D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, N. Weaver, “Inside the Slammer Worm”, IEEE Security & Privacy, July 2003. 6

Kalman Filter Estimation n Equivalent to Recursive Least Square Estimator: u u Give estimation at each discrete time. Robust to noise. n System: Discrete-time simple epidemic model n System state: u u n Worm infection rate a. (a= b. N, exponential growth rate at beginning) Epidemic parameter b. (worm infectious ability) Measurement from monitors: u Ci : cumulative # of observed infected, Zi : # of scans at time i. 7

Kalman Filter Estimation System: where Kalman Filter for estimation of Xt : 8

Code Red simulation experiments Population: N=360, 000, Scan rate h = N(358/min, 1002), Monitored IP space 220, Consider background noise Infection rate: a = 1. 8/hour, Initially infected: I 0=10 Monitoring interval: D = 1 minute Before 2% (223 min): estimate is already stabilized and oscillating a little around a positive constant value 9

SQL Slammer simulation experiments Population: N=100, 000, Monitored IP space 220, Scan rate h = N(4000/sec, 20002), Initially infected: I 0=10 Monitoring interval: D = 1 second, Consider background noise Before 1% (45 sec): estimate is already stabilized and oscillating around a positive constant value 10

Early detection of Blaster n Blaster: sequentially scans from a starting IP address: u u n 40% from local Class C address. 60% from a random IP address. It follows simple epidemic model. After using low-pass filter 11

Bias correction for uniform-scan worms n Bernoulli trial for a worm to hit monitors (hitting prob. = p ). Bias correction: : Average scan rate Monitoring 217 IP space Monitoring 214 IP space Bias correction can provide unbiased estimate of It 12

Prediction of Vulnerable population size N Direct from Kalman filter: Alternative method: h : A worm sends out h scans per D time (derived from egress scan monitor) Estimation of population N 13

Use exponential growth model At the early stage: : observation data Model #2: Autoregressive (AR) model Early stage of worm propagation Model #3: Transformed linear model 14

Comparison between three estimation models Epidemic model n AR exponential model Transformed linear model Observations u u u AR exponential model is smoother than epidemic model Transformed linear model gives best results Detect a worm when it infects about 0. 5% population 15

Simple analysis of three estimation models n Why AR exponential model is smoother than epidemic model? u n Introduced errors from measurement data: Ø Epidemic model Ø AR exponential model Why transformed linear model is better than AR model? assume AR exponential model: Transformed linear model: where 16

Summary n Trend detection: non-threshold-based methodology u u u n Principle: detect traffic trend, not burst Pros : Robust to background noise low false alarm rate Cons: Rely on worm model, representation of measurement data Epidemic model, exponential model Using low-pass filter on noisy observation data For uniform-scan worms u Bias correction: u Forecasting N: ( IPv 4 ) : scanning IP space : scan hitting prob. Routing worm : Average scan rate : Infection rate : cumulative # of observed infectious 17