1 Monitoring and Early Warning for Internet Worms Authors: Cliff C. Zou, Lixin Gao, Weibo Gong, Don Towsley Univ. Massachusetts, Amherst Publish: 10th ACM Conference on Computer and Communication Security (CCS'03), 2003 Presenter: Cliff C. Zou (01/12/2006)

2 Monitor:  Worm scans to unused IPs  TCP/SYN packets  UDP packets How to detect an unknown worm at its early stage? Unused IP space Monitored traffic Internet noisy Monitored data is noisy Local network

3 Worm anomaly  other anomalies?  A worm has its own propagation dynamics Deterministic models appropriate for worms Reflection Can we take advantage of worm model to detect a worm?

4 1% 2% Worm model in early stage Initial stage exhibits exponential growth

5 “Trend Detection”  Detect traffic trend, not burst Trend: worm exponential growth trend at the beginning Detection: the exponential rate should be a positive, constant value Worm traffic Non-worm traffic burst Exponential rate  on-line estimation Monitored illegitimate traffic rate

6 Why exponential growth at the beginning? The law of natural growth  reproduction  When interference is negligible (beginning phase) Attacker’s incentive: infect as many as possible before people’s counteractions If not, a worm does not reach its spreading speed limit Slow spreading worm detected by other ways  Security experts manual check  Honeypot, …

7 Model for estimate of worm exponential growth rate  Exponential model: : monitoring noise Z t : # of monitored scans at time t yield

8 Estimation by Kalman Filter System: where Kalman Filter for estimation of X t :

9 Code Red simulation experiments Population: N=360,000, Infection rate:  = 1.8/hour, Scan rate  = N(358/min, ), Initially infected: I 0 =10 Monitored IP space 2 20, Monitoring interval: 1 minute Consider background noise At 0.3% (157 min): estimate stabilizes at a positive constant value

10 Damage evaluation — Prediction of global vulnerable population N yield Accurate prediction when less than 1% of N infected

11 Monitoring 2 14 IP space ( p =4 £ ) Damage evaluation — Estimation of global infected population I t : fraction of address space monitored : cumulative # of observed infected hosts by time t : per host scan rate : Prob. an infected to be observed by the monitor in a unit time # of unobserved Infected by t # of newly observed (t  t+1)

12 What’s the paper’s contribution? A novel approach in anomaly detection  Popular approach is based on static threshold  Paper exploits worm dynamics  Dynamics in a series of time Worm potential damage prediction  Estimate global infected based on local info  Predict global vulnerable population

13 Why this paper can be published? Different approach from popular ways  Model-based anomaly detection  Fresh view point --- interesting Solid (fancy) mathematic background  Math is appropriate  A pure experimental report is not (good) enough for academic paper Timely appearance  Catch a promising/hot topic ASAP  Rely on: advisors, (conference) paper, tech news, colleagues,

14 What’s the paper’s weakness? Early detection provides limited information  Does not provide signature for worm defense  Does not (accurately) identify global infected hosts Require a large empty IP space for monitoring  Not very good for individual local network Worm damage prediction results are accurate only for uniform-scan worms  Many worms using biased scanning strategies

15 How to improve the paper? I have improved CCS’03 conference paper and published in IEEE Tran. on Networking Detect a worm earlier  Conference paper uses simple worm model, TON’s uses exponential model (several times faster) Consider the limitation of monitoring system  TON’s paper adds analysis/experiments of the monitoring problem for non-uniform scan worms