Simulating realistic network worm traffic for worm warning system design and testing

ABSTRACT

Reproducing the effects of large-scale worm attacks in a laboratory setup in a realistic and reproducible manner is an important issue for the development of worm detection and defense systems. In this paper, we describe a worm simulation model we are developing to accurately model the large-scale spread dynamics of a worm and many aspects of its detailed effects on the network. We can model slow or fast worms with realistic scan rates on realistic IP address spaces and selectively model local detailed network behavior. We show how it can be used to generate realistic input traffic for a working prototype worm detection and tracking system, the Dartmouth ICMP BCC: System/Tracking and Fusion Engine (DIB:S/TRAFEN), allowing performance evaluation of the system under realistic conditions. Thus, we can answer important design questions relating to necessary detector coverage and noise filtering without deploying and operating a full system. Our experiments indicate that the tracking algorithms currently implemented in the DIB:S/TRAFEN system could detect attacks such as Code Red v2 and Sapphire/Slammer very early, even when monitoring a quite limited portion of the address space, but more sophisticated algorithms are being constructed to reduce the risk of false positives in the presence of significant "background noise" scanning.

REFERENCES

• 1: Labrea. http://www.hackbusters.net/LaBrea.
• 2: Ssfnet web site. http://www.ssfnet.org/.
• 3: F. Baker. Rfc 1812: Requirements for IP version 4 routers. Request for Comments 1812, June 1995.
• 4: Vincent Berk, Wayne Chung, Valentino Crespi, George Cybenko, Robert Gray, Diego Hernando, Guofei Jiang, Han Li, and Yong Sheng. Process Query Systems for Surveillance and Awareness. In Proceedings of the SCI 2003, Orlando, Florida, July 2003.
• 5: Vincent H. Berk, Robert S. Gray, and George Bakos. Using Sensor Networks and Data Fusion for Early Detection of Active Worms. In Proceedings of AeroSense 2003: SPIE's 17th Annual International Symposium on Aerospace/Defense Sensing, Simulation, and Controls, Orlando, Florida, April 2003.
• 6: Z. Chen, L. Gao, and K. Kwiat. Modeling the Spread of Active Worms. INFOCOM 2003, 2003.
• 7: Brent N. Chun, Jason Lee, and Hakim Weatherspoon. Netbait: A distributed worm detection service. Available at http://netbait.plain-lab.org/., 2003.
• 8: Cisco. Dealing with mallocfail and high CPU utilization resulting from the "Code Red" worm. http://www.cisco. com/warp/public/-63/ts_codred_worm.shtml, October 2001.
• 9: James H. Cowie , David M. Nicol , Andy T. Ogielski, Modeling the Global Internet, Computing in Science and Engineering, v.1 n.1, p.42-50, January 1999 [doi>10.1109/5992.743621 ]
• 10: D.J. Daley and J. Gani. Epidemic Modelling: An Introduction. Cambridge University Press, Cambridge, UK, 1999.
• 11: Silicon Defense. Countermalice---Worm Containment System. http://www.silicondefense.com/products/countermalice/, 2003.
• 12: Sally Floyd , Vern Paxson, Difficulties in simulating the internet, IEEE/ACM Transactions on Networking (TON), v.9 n.4, p.392-403, August 2001 [doi>10.1109/90.944338]
• 13: Jeffrey O. Kephart , Steve R. White, Measuring and Modeling Computer Virus Prevalence, Proceedings of the 1993 IEEE Symposium on Security and Privacy, p.2, May 24-26, 1993
• 14: M. Liljenstam , Y. Yuan , B. J. Premore , D. Nicol, A Mixed Abstraction Level Simulation Model of Large-Scale Internet Worm Infestations, Proceedings of the 10th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunications Systems (MASCOTS'02), p.109, October 11-16, 2002
• 15: David Moore , Vern Paxson , Stefan Savage , Colleen Shannon , Stuart Staniford , Nicholas Weaver, Inside the Slammer Worm, IEEE Security and Privacy, v.1 n.4, p.33-39, July 2003 [doi>10.1109/MSECP.2003.1219056]
• 16: David Moore , Colleen Shannon , k claffy, Code-Red: a case study on the spread and victims of an internet worm, Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, November 06-08, 2002, Marseille, France [doi>10.1145/637201.637244]
• 17: David Moore, Colleen Shannon, Geoffrey M. Voelker, and Stefan Savage. Internet quarantine: Requirements for containing self-propagating code. In Proceedings of the 22nd Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM 2003), April 2003.
• 18: David Moore, Geoffrey M. Voelker, and Stefan Savage. Inferring Internet Denial-of-Service activity. In Proceedings of the 10th USENIX Security Symposium (USENIX'01), Washington, DC, August 2001.
• 19: Lawrence R. Rabiner. A Tutorial on Hidden Markov Models and Selected Applications in Speech Recognition. Proceeding of the IEEE, 77, Num. 2:257--286, 1989.
• 20: Donald B. Reid. An algorithm for Tracking Multiple Targets. IEEE Transactions on Automatic Control, AC-24, Num. 6:843--854, 1979.
• 21: S. Staniford. Code Red Analysis Pages: July infestation analysis. http://www.silicondefense.com/cr/july.html, 2001.
• 22: Stuart Staniford , Vern Paxson , Nicholas Weaver, How to Own the Internet in Your Spare Time, Proceedings of the 11th USENIX Security Symposium, p.149-167, August 05-09, 2002
• 23: A. Turner and M. Bing. project page (sourceforge). http://tcpreplay.sourceforge.net/, 2003.
• 24: Peer Iljitsch Beijnum , Iljitsch Van Beijnum, Bgp, O'Reilly & Associates, Inc., Sebastopol, CA, 2002
• 25: Vinod Yegneswaran , Paul Barford , Johannes Ullrich, Internet intrusions: global characteristics and prevalence, Proceedings of the 2003 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, June 11-14, 2003, San Diego, CA, USA
• 26: Cliff Changchun Zou , Weibo Gong , Don Towsley, Code red worm propagation modeling and analysis, Proceedings of the 9th ACM conference on Computer and communications security, November 18-22, 2002, Washington, DC, USA [doi>10.1145/586110.586130]
• 27: Cliff C. Zou, Lixin Gao, Weibo Gong, and Don Towsley. Monitoring and early warning for internet worms. Technical Report TR-CSE-03-01, University of Massachusetts at Amherst, 2003.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.4 PERFORMANCE OF SYSTEMS
      Subjects: Modeling techniques

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)
      C.2.3 Network Operations
          Subjects: Network monitoring
      C.2.5 Local and Wide-Area Networks
          Subjects: Internet (e.g., TCP/IP)

General Terms:
Experimentation, Measurement, Performance, Security

Keywords:
code red, network modeling and simulation, network security, slammer, worm detection systems, worms