1 Worm Modeling and Defense Cliff C. Zou, Don Towsley, Weibo Gong Univ. Massachusetts, Amherst

2 Internet Worm Introduction Scan-based worms:  Example: Code Red, Slammer, Blaster, Sasser, …  No human interaction  Fast (automatic defense)  Need vulnerability  Fewer incidents  Network-based blocking  Modeling: no (week) topological issue  Epidemic models worms:  Example: Melissa, Love letter, Sircam, SoBig, MyDoom, …  Human activation  Slower  Need no vulnerability  More incidents  Defense on servers  Modeling: address logical topology  No math model yet Nimda: mixed infection MyDoom: search engine

3 Topology — Heavy-tailed Distributed topology degree distr. Size distr. of address books  Popular list: one list address corresponds to many.  worms find all addresses on compromised computers.  address books, Web cache, text documents, etc. We study propagation on power law topologies.  Generators available ; best candidate to represent heavy-tailed topology. Complementary cumulative distribution (May 2002: > 800,000 Yahoo groups)

4 Worm Simulation Model Discrete time simulation Topology: undirected graph  Power law, small world, random graph Modeling behavior of individual user  Worm attachment opening prob.  checking time interval  Following any distribution: Exponential, Erlang, Constant. Modeling the entire user population  normal distr.

5 Propagation Stochastic Effect Power law network: 100,000 nodes, average degree = 8 N t : the number of infectious at time t. N 0 = 2 randomly selected 100 simulation runs for each experiment Random effect in simulation Initially infected nodes and initial infection are critical. It is possible that no one is infected except N 0 When no neighboring nodes open attachments.

6 Initially infected nodes with different node degree Initially infected nodes are more important in a sparsely connected network than a densely connected network Avg. degree = 8 Avg. degree = 20

7 Effect of checkingtime variability An worm propagates faster when the checking time is more stochastically variable.  Snowball effect: Before worm copies give birth to the next generation in the less variable system, worm copies in the more variable system have already given birth to several generations. Random variable Exponential 3rd-order Erlang Constant

8 Topology Effect on Worm Propagation An worm propagates faster on a power-law topology than on the other two.  Highly connected nodes are infected earlier.  They amplify worm propagation speed by shooting out more copies. Topology effect Avg. degree of infected nodes (1000 simulation runs)

9 Immunization Defense against Worms Static immunization defense:  A fraction of nodes are immune to an worm before its outbreak.  No nodes will be immunized during the worm’s outbreak. Selective immunization:  Immunizing the mostly connected nodes.  Effective for a power-law network  Nodes have very variable node degrees 3 ~ 2000+

10 Selective Immunization Defense Selective immunization defense is more effective on a power law topology than on the other two.  Due to the percolation property of a topology. Power law topology Small world topology

11 Percolation and Phase Transition Selective percolation with p :  Removing top p percent of mostly connected nodes.  Corresponding to selective immunization.  Newman et al. studied uniform percolation. Selective percolation property:  Connection ratio:  fraction of remained nodes that are connected.  Remaining link ratio:  fraction of remained links.  Phase transition  selective percolation threshold  Disjoint the remaining network when

12 Why different effect with 5% selective immunization?  Power law topology: removing 55.5% links  Small world (random graph) topology: removing < 20% links worm prevention via selective immunization (Phase transition) :  30% for the power law topology  Around 70% for the small world and random graph topologies. Power law topology Small world topology Percolation and Phase Transition

13 Summary topology is a heavy-tailed distributed topology. The impact of a power law topology on worm propagation is mixed:  Cons: an worm spreads faster than on a small world or a random graph topology.  Pros: static selective immunization defense is more effective.

14 Future Work Mathematical modeling  Difficulty: considering an arbitrary topology Directed graph for topology  One-way address relationship  Heavy tailed distr. definition? Topology generator? Dynamic immunization defense Short-term focus: Enterprise network defense