Exact Propagation Modeling of Permutation-Scanning Worms Parbati Kumar Manna Dr. Shigang Chen Dr. Sanjay Ranka University of Florida

2 Internet Worm Huge damage potential Propagation is automatic (mostly) Characterized by its behavior at  Host Level  How it compromises the host  What it does on the compromised host  Network Level  How it covers the whole of the target population

3 Motivation for Hacker Achieve desirable goals of scanning  Infection speed  Stealth  Fault tolerance Bad Good Time  V = size of Vulnerable host population % V # Infected = # active + # retired

4 Random-Scanning (RCS) Worm  Wastes scanning power  No idea about when to stop  Easy to detect Simple Divide scheme  Not fault tolerant  Unequal load Optimal Scanning Strategy 1,100 61,100 21,60 91,100 51,5556,60 98, ,90 86,87

5 Random divide scheme  Fault tolerant  Starting point of scan is random  Sequential scan - easy to detect Permutation-Scanning scheme  Fault tolerant, Stealthy, Fast Optimal Scanning Strategy

6 Permutation-Scanning Randomizes the real address space into a Permutation Ring Each freshly infected host starts scanning from a random location Retires upon hitting an already infected host Real address space Permutation ring new host jumps about to infect active retired Gets infected, jumps

7 Why Model? Simulation takes long time  16 hrs / run for 400M hosts Simulation overhead could be prohibitively high  Impossible to scan full IPv6 Simulation does not always provide mathematical insight

8 Find # (active hosts) scanning – effectively (X) – ineffectively (Y) Among the scans from the effective hosts (X), calculate how many are hitting uninfected hosts. Find how many X and Y hosts hit a pre-infected host (and retire). Solution Outline X1X1 X2X2 Y covered area

9 Vulnerable Host Classification

10 State Diagram

11 Interaction among Infected Hosts while scanning

12 Final Propagation Model for Permutation Worm Y X X  (effective) (ineffective) Fraction (covered area)

13 Final Propagation Model for Permutation Worm infected Retired Active

14 Closed-Form Solution infected Active Retired Same as Random Scanning worm

15 Model Vs. Simulation N = 2 23 V = 2 13 hitlist size = 100

16 Extending Model to k-jump Permutation-Scanning Worm Instead of retiring, jump another time and restart scanning Will retire only after hitting more than k old infections Higher infection speed and network footprint

17 State Diagram for k-jump Permutation-Scanning Worm

18 Propagation Model for k-jump Permutation Worm Similar equations for d  ( t ), dy(t)

19 Propagation Results for k-jump permutation worm N=2 23 V=2 13 v =100

20 Designing Fault-Tolerant, Fast, yet Stealthy Worm Convert the existing RCS worm –Use a full-period PRNG –Impart a termination condition of retiring only after hitting its first old infection Same infection speed, less network footprint

21 Scanning Peak Independent of the Hitlist Size

22 Contributions Obtained propagation model for Permutation-Scanning worms Extended modeling for multiple-jump Obtained the effect of various worm/network parameters:  Bigger hitlist (v)  Larger V (more vulnerable computers)  Bigger N (IPv4  IPv6)  Increased k (more jumps allowed)

23 Questions

24 Thank you