Featured Research

from universities, journals, and other organizations

Code defends against 'stealthy' computer worms

Date:
February 4, 2010
Source:
Penn State
Summary:
Self-propagating worms are malicious computer programs, which, after being released, can spread throughout networks without human control, stealing or erasing hard drive data, interfering with pre-installed programs and slowing, even crashing, home and work computers. Now a new code, or algorithm, created by researchers targets the "stealthiest" of these worms, containing them before an outbreak can occur.

Self-propagating worms are malicious computer programs, which, after being released, can spread throughout networks without human control, stealing or erasing hard drive data, interfering with pre-installed programs and slowing, even crashing, home and work computers. Now a new code, or algorithm, created by Penn State researchers targets the "stealthiest" of these worms, containing them before an outbreak can occur.

"In 2001 the 'Code Red' worms caused $2 billion dollars worth of damage worldwide," said Yoon-Ho Choi, a postdoctoral fellow in information sciences and technology, Penn State. "Our algorithm can prevent a worm's propagation early in its propagation stage."

Choi and his colleagues' algorithm defends against the spread of local scanning worms that search for hosts in "local" spaces within networks or sub-networks. This strategy allows them access to hosts that are clustered, which means once they infect one host, the rest can be can be infected quickly. There are many types of scanning worms, but Choi calls these worms the stealthiest because they are the most efficient and can evade even the best worm defenses.

A worm outbreak can begin with the infection of a single computer. After infection, a worm begins to probe a set of random, local or enterprise IP addresses, searching for more vulnerable hosts. When one is found the worm sends out a probe, or packet, to infect it.

"A local scanning worm can purposely scan a local or enterprise network only," said Choi. "As the size of the susceptible population increases, the worm's virulence increases."

The researchers' algorithm works by estimating the size of the susceptible host population. It then monitors the occurrence of infections within it and sets a threshold value just equal to or below the average number of scans necessary to infect a host by an infected host.

If the scanning worm's number of scans carrying a specific destination port number exceeds the threshold, the algorithm quarantines the worm. The algorithm then breaks down the network into many small networks, or cells, which in some cases might be only one computer. A worm can spread within the cells, but not between the cells. This way the algorithm can isolate an infected host or small cluster of infected hosts housing the worm.

"By applying the containment thresholds from our proposed algorithm, outbreaks can be blocked early," said Choi.

To test the effectiveness of their algorithm the researchers ran a series of computer simulations and emulations using different scanning strategies of local scanning worms. Results showed that their algorithm was an efficient estimator of worm virulence and could determine the size of the susceptible host population after only a few infections.

"Our evaluation showed that the algorithm is reliable in the very early propagation stage and is better than the state-of-the-art defense," said Choi.

Choi, working with Lunquan Li, assistant professor, Institute of Microelectronics, Chinese Academy of Sciences, Beijing, and his Penn State colleagues, Peng Liu, associate professor, information sciences and technology, and George Kesidis, professor, electrical engineering and computer science and engineering, published their work in the February issue of Computers and Security.

According to Choi, local scanning worms are constantly evolving. They are becoming more complicated and increasingly efficient. As a result, worm outbreaks pose a real threat to networked systems. Because many networked home and office computers are susceptible to local scanning worms this algorithm may be an effective defense against damaging worm outbreaks.


Story Source:

The above story is based on materials provided by Penn State. Note: Materials may be edited for content and length.


Cite This Page:

Penn State. "Code defends against 'stealthy' computer worms." ScienceDaily. ScienceDaily, 4 February 2010. <www.sciencedaily.com/releases/2010/02/100201113758.htm>.
Penn State. (2010, February 4). Code defends against 'stealthy' computer worms. ScienceDaily. Retrieved September 1, 2014 from www.sciencedaily.com/releases/2010/02/100201113758.htm
Penn State. "Code defends against 'stealthy' computer worms." ScienceDaily. www.sciencedaily.com/releases/2010/02/100201113758.htm (accessed September 1, 2014).

Share This




More Computers & Math News

Monday, September 1, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

Apple's Rumored iWatch Could Cost $400

Apple's Rumored iWatch Could Cost $400

Newsy (Aug. 31, 2014) Apple is expected to charge a premium for its still-rumored wearable device. Video provided by Newsy
Powered by NewsLook.com
Young Entrepreneurs Get $100,000, If They Quit School

Young Entrepreneurs Get $100,000, If They Quit School

AFP (Aug. 29, 2014) Twenty college-age students are getting 100,000 dollars from a Silicon Valley leader and a chance to live in San Francisco in order to work on the start-up project of their dreams, but they have to quit school first. Duration: 02:20 Video provided by AFP
Powered by NewsLook.com
JPMorgan Chase Confirms Possible Cyber Attack

JPMorgan Chase Confirms Possible Cyber Attack

Reuters - US Online Video (Aug. 28, 2014) Attackers stole checking and savings account information and lots of other data from JPMorgan Chase, according to the New York Times. Other banks are believed to be victims as well. Fred Katayama reports. Video provided by Reuters
Powered by NewsLook.com
Spend 2 Minutes Watching This Smartwatch Roundup

Spend 2 Minutes Watching This Smartwatch Roundup

Newsy (Aug. 28, 2014) LG announces a round-faced smartwatch, Samsung adds 3G connectivity to its latest wearable, and Apple will reportedly announce the iWatch on Sept. 9. Video provided by Newsy
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:
from the past week

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins