Darknet-Based Inference of Internet Worm Temporal Characteristics
Darknet-Based Inference of Internet Worm Temporal Characteristics
复制标题
基于暗网的网络蠕虫时间特征推断
DOI：
--
复制
发表时间：
2010
影响因子：
6.8
通讯作者：
Chao Chen
中科院分区：
文献类型：
--
作者：
Qian Wang;Zesheng Chen;Chao Chen
网络蠕虫攻击对网络安全和管理构成重大威胁。在这项工作中，我们创造了互联网蠕虫断层扫描这个术语，因为它是通过观察暗网或监控可路由但未使用的IP地址空间的网络望远镜来推断互联网蠕虫的特征。在互联网蠕虫断层扫描的框架下，我们试图推断互联网蠕虫的时间行为，即主机感染时间和蠕虫感染序列，从而准确定位患者零感染或初始感染的主机。具体地说，我们应用统计估计技术，提出了矩估计、最大似然估计和线性回归估计的方法。我们的分析和经验表明，我们提出的估计器可以比以前工作中使用的朴素估计器更好地推断蠕虫的时间特征。我们还证明了我们的估计器可以应用于使用不同扫描策略的蠕虫，例如随机扫描和局部扫描。
Internet worm attacks pose a significant threat to network security and management. In this work, we coin the term Internet worm tomography as inferring the characteristics of Internet worms from the observations of Darknet or network telescopes that monitor a routable but unused IP address space. Under the framework of Internet worm tomography, we attempt to infer Internet worm temporal behaviors, i.e., the host infection time and the worm infection sequence, and thus pinpoint patient zero or initially infected hosts. Specifically, we apply statistical estimation techniques and propose method of moments, maximum likelihood, and linear regression estimators. We show analytically and empirically that our proposed estimators can better infer worm temporal characteristics than a naive estimator that has been used in the previous work. We also demonstrate that our estimators can be applied to worms using different scanning strategies such as random scanning and localized scanning.