1. Worm Defense

2. Outline  Internet Quarantine: Requirements for Containing Self-Propagating Code  Netbait: a Distributed Worm Detection Service  Midgard Worms: Sudden Nasty Surprise from a Large Resilient Zombie Army  Discussion

3. Internet Quarantine Outline  SI epidemic model and Code Red propagation model.  Simulations on Code Red Propagation and Containment System Deployment.  Conclusion

4. How to mitigate the threat of worms  Three approaches Prevention Treatment Containment:  E.g. firewall, filters, others?  Containment is used to protect individual networks, and isolate infected hosts  Most viable of the three strategies Automated Do not require universal deployment on hosts

5. SI Model (1)  In this work, a vulnerable machine is described as susceptible (S) machine.  A infected machine is described as infected (I).  Let N be the number of vulnerable machines.  Let S(t) be the number of susceptible host at time t, and s(t) be S(t)/N, where N = S(t) + I(t).  Let I(t) be the number of infected hosts at time t, and i(t) be I(t)/N.  Let be the contact rate of the worm.  Define:

6. SI Model (2) Solving the differential equation: where T is a constant

7. Code Red Propagation Model (1)  Code Red generates IPv4 address by random. Thus, there are totally 2^32 addresses.  Let r be the probe rate of a Code Red worm.  Thus:

8. Code Red Propagation Model (2)  Two problems Cannot model preferential targeting algorithm.  E.g. select targets form address ranges closer to the infected host. The rate only represents average contact rate.  E.g. a particular epidemic may grow significantly more quickly by making a few lucky targeting decisions in early phase.

9. Code Red Propagation Model (3)  Example on 100 simulations on Code Red propagation model: After 4 hours: 55% on average 80% in 95 th percentiles 25% in 5 th percentiles

10. The Problem Is…  How effectively can any containment approach counter a worm epidemic on the Internet?  What properties should be considered?

11. Modeling Containment Systems (1)  A containment system has three important properties: Reaction time – the time necessary for  Detection of malicious activity,  Propagation of the containment information to all hosts participating the system, and  Activating any containment strategy.

12. Modeling Containing Systems (2) Containing Strategy  Address blacklisting Maintain a list of IP addresses that have been identified as being infected. Drop all the packets from one of the addresses in the list. E.g. Mail filter. Advantage: can be implemented easily with existing firewall technology.

13. Modeling Containing Systems (3)  Content filtering Requires a database of content signatures known to represent particular worms. This approach requires additional technology to automatically create appropriate content signatures. Advantage: a single update is sufficient to describe any number of instances of a particular worm implementation.  Deployment scenarios Ideally, a global deployment is preferable. Practically, a global deployment is impossible. May be deploying at the border of ISP networks.

14. Idealized Deployment (1)  Simulation goal To find how short the reaction time is necessary to effectively contain the Code-Red style worm.  Simulation Parameters: 360,000 vulnerable hosts out of 2 32 hosts. Probe rate of a worm : 10 per sec.  Containment strategy implementation Address blacklisting  Send IP addresses to all participating hosts. Content filtering  Send signature of the worm to all participating hosts.

15. Assumptions  A perfect containment system Universally deployed systems The information is distributed simultaneously

16. Idealized Deployment (2)  Result: content filtering is more effective. 20 min 2 hr Number of susceptible host decreases Worms unchecked

17. Idealized Deployment (3)  Next goal: To find the relationship between containment effectiveness and worm aggressiveness. Figures are in log-log scale.

18. Idealized Deployment (4) Percentage of infected hosts Address blacklisting is hopeless when encountering aggressive worms.

19. Practical Deployment (1)  Network Model AS sets in the Internet:  routing table on July 19,2001  1 st day of the Code Red v2 outbreak. A set of vulnerable hosts and ASes:  Use the hosts infected by Code Red v2 during the initial 24 hours of propagation.  A large and well-distributed set of vulnerable hosts. 338,652 hosts distributed in 6,378 ASes.

20. Practical Deployment (2)  Deployment Scenarios Use content filtering only. Filtering firewall are deployed on the borders of both the customer networks, and ISP’s networks. Deployment of containment strategy.

21. Practical Deployment (3)  Reaction time: 2hrs Difference in performance because of the difference in path coverage.

22. Practical Deployment (4) System fails to contain the worm.

23. Conclusion  Explore the properties of the containment system Reaction time Containment strategy Deployment scenario  In order to contain the worm effectively Require automated and fast methods to detect and react to worm epidemics. Content filtering is the most preferable strategy. Have to cover all the Internet paths when deploying the containment systems.

24. Outline  Internet Quarantine: Requirements for Containing Self-Propagating Code  Netbait: a Distributed Worm Detection Service  Midgard Worms: Sudden Nasty Surprise from a Large Resilient Zombie Army  Discussion

25. Main Idea Netbait: A planetary-scale service for distributed detection of Internet worm  Identify the machines on a given network been comprised  Based on the collective view of a set of geographically distributed machines  An efficient distributed query processing system

26. Worm detection Internet worms: probe remote machines and explore remote system flaws Intrusion detection systems, such as Snort, can detect the exploits The problem is: how to identify those infected machines?  Why use multiple machines?  Why use multiple distributed machines?

27. NETBAIT Design A distributed query processing system Each node keeps a logical database table of intrusion detection system data Queries are expressed using SQL Queries are processed parallely, with the query results compressed Load balanced clients

28. Data Collection and Indexing  Each node observes the requests for network services  Log the matches into the database  Two types of data Without signature With signature

29. Overlay Construction and Maintenance  A spanning tree structure, capable of Multicasting of queries Collection of results  Use Tapestry Node-ID Every node as the root node of its own unique spanning tree Tree construction Tree maintainence

30. Distributed Query Processing  Queries are distributed to the nodes for evaluation  Two classes of queries  The logical Table  Load balancing “Netbait root” “Tapestry root”  Aggregation and Encoding

31. Results and Analysis  The benefits of sharing  The benefit of multiple viewpoints

32. Discussion  Netbait and Sequoia The similarity  Distributed  Sharing security information What could we learn from it?  Overlay construction

33. Outline  Internet Quarantine: Requirements for Containing Self-Propagating Code  Netbait: a Distributed Worm Detection Service  Midgard Worms: Sudden Nasty Surprise from a Large Resilient Zombie Army  Discussion

34. Midgard worms  Midgard The worms which build up a highly resilient code dissemination structure based on creating an overlay network of compromised nodes

35. Structure  A resilient self-organizing overlay of zombie nodes  The attacker could disseminating the exploit code to the zombies  Could be trees, hypercube, butterflies or a random graph  One kind: Revere

36. Formation and Dissemination  Discover other zombies The “physical parent Wait for infection and probing Three-way-handshake procedure Share lists of zombies  Parent selection Some permanent parents Exchange subset of parent list  Push-based design Public key + authenticity

37. Defending against Midgard  Limit the spread of Midgard  Finding Midgard Worm Zombies Searching for Listeners Searching for heartbeats Traffic analysis Tracing the Overlay  Zombie Disinfection  Protecting Uninfected Machines

38. So what can we do with Midgard?  ???

39. Outline  Internet Quarantine: Requirements for Containing Self-Propagating Code  Netbait: a Distributed Worm Detection Service  Midgard Worms: Sudden Nasty Surprise from a Large Resilient Zombie Army  Discussion

40. Thank you.