Worm Origin Identification Using Random Moonwalks

Worm Origin Identification Using Random Moonwalks (2005)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Yinglian Xie , Vyas Sekar , David A. Maltz , Michael K. Reiter , Hui Zhang

Venue:	In IEEE Symposium on Security and Privacy
Citations:	30 - 10 self

Versions

Version History

Metadata Version 1

Datum	Value	Source
TITLE	Worm Origin Identification Using Random Moonwalks	INFERENCE
AUTHOR NAME	Yinglian Xie	SVM HeaderParse 0.2
AUTHOR AFFIL	Carnegie Mellon University £	SVM HeaderParse 0.2
AUTHOR NAME	Vyas Sekar	SVM HeaderParse 0.2
AUTHOR AFFIL	Carnegie Mellon University £	SVM HeaderParse 0.2
AUTHOR NAME	David A. Maltz	SVM HeaderParse 0.2
AUTHOR AFFIL	Carnegie Mellon University £	SVM HeaderParse 0.2
AUTHOR NAME	Michael K. Reiter	SVM HeaderParse 0.2
AUTHOR AFFIL	Carnegie Mellon University £	SVM HeaderParse 0.2
AUTHOR NAME	Hui Zhang	SVM HeaderParse 0.2
AUTHOR AFFIL	Carnegie Mellon University £	SVM HeaderParse 0.2
ABSTRACT	We propose a novel technique that can determine both the host responsible for originating a propagating worm attack and the set of attack flows that make up the initial stages of the attack tree via which the worm infected successive generations of victims. We argue that knowledge of both is important for combating worms: knowledge of the origin supports law enforcement, and knowledge of the causal flows that advance the attack supports diagnosis of how network defenses were breached. Our technique exploits the “wide tree ” shape of a worm propagation emanating from the source by performing random “moonwalks” backward in time along paths of flows. Correlating the repeated walks reveals the initial causal flows, thereby aiding in identifying the source. Using analysis, simulation, and experiments with real world traces, we show how the technique works against both today’s fast propagating worms and stealthy worms that attempt to hide their attack flows among background traffic. 1	SVM HeaderParse 0.2
YEAR	2005	INFERENCE
VENUE	In IEEE Symposium on Security and Privacy	INFERENCE
VENUE TYPE	CONFERENCE	INFERENCE
PAGES	242--256	INFERENCE
CITATIONS	29 found	ParsCit 1.0