ITR: Defending Against Virus Propagation on the Internet

自从莫里斯蠕虫袭击互联网以来，病毒和蠕虫的进化使反病毒分析人员忙于开发新的扫描和检测功能。新病毒继续超越现有技术，造成严重破坏。很明显，现有的策略是不够的，而只是助长了病毒编写者和反病毒行业之间正在进行的军备竞赛。该提案解决了这样一个问题：“反病毒技术的下一个重大突破是什么？下一次革命是什么？”pi建议CMU、赛门铁克和CERT共同努力，研究全球防御机制和部署策略。本研究将从整个网络的角度出发，而不是从单个节点的角度来处理这个问题。除了直接影响之外，该问题还提出了对理论家和实践者都极具吸引力的研究挑战。初步的研究表明，在自组织临界性和病毒传播的原理之间似乎有相似之处——一旦传播的动态状态越过了分布的临界水平，病毒就会蓬勃发展并最终达到流行。这与传统的流行病阈值形成对比，传统的流行病阈值仅以病毒的静态出生率和死亡率为特征。了解病毒分布的这一关键水平是一个有趣的问题，它很可能为阻止计算机病毒的传播指明新的方法。研究数学模型（如动态模型）与病毒传播之间的类比是本提案的中心主题。ppi在这项工作中提出了三个主要重点。1)确定现代病毒和蠕虫的拓扑结构。有人认为，病毒传播遵循幂律结构，很像物理互联网拓扑结构。然而，没有理由相信病毒式传播会反映网络的物理拓扑结构。相反，有证据表明它们遵循某种社会网络，或者在某些蠕虫的情况下遵循随机网络。我们的工作将是第一个使用真实攻击数据和用户数据开发病毒传播拓扑的确定模型。2)开发捕获虚拟拓扑上传播行为的新模型。具体来说，pi感兴趣的是建模a)拓扑感知传播行为，b)环境因素的影响，以及c)感染（耗散）和防御（反馈力）之间的动态。3)运用数学模型对以网络为中心的防御策略进行发展和推理。PI团队是CMU计算机和通信安全中心（C3S）的一部分。该中心的目标之一是促进安全教育。我们正在设计一个新的学位课程——信息安全硕士。我们期望这项合作研究能够激发学生的兴趣，并促进信息安全方面的进一步研究。赛门铁克将在整个过程中成为行业合作伙伴。具体来说，他们将向我们提供他们的专有数据库，其中包含有关病毒事件的大量数据集。此外，其中两个pi与CERT（软件工程研究所的一部分，由CMU运营的FFRDC）有联合任命，并且可以访问与真实病毒事件相关的大量且不断增长的数据体。

Since the Morris worm hit the Internet, the evolution of viruses and worms has kept anti-virus analysts busy developing new scanning and detection capabilities. New viruses continue to outsmart current technologies and wreak havoc. It is clear that existing strategies do not suffice but rather only contribute to the ongoing arms race between virus writers and the anti-virus industry. This proposal addresses the question: "What is the next big break, the next revolution in anti-virus technology?"The PIs propose a joint effort between CMU, Symantec and CERT to research global defense mechanisms and deployment strategies. Instead of approaching the problem from the perspective of individual nodes, this research will take on a network-wide point of view. In addition to the immediate impact, the problem presents research challenges that are extremely appealing to theorists and practitioners alike.The preliminary study suggests that there appears to be an analogy between the principles of self-organized criticality and virus propagation-once the dynamic state of propagation crosses a critical level of distribution, the virus flourishes and attains eventual prevalence. This is in contrast to the traditional epidemic threshold that is characterized using only static birth and death rate of the virus. Understanding this critical level of distribution is an interesting problem, and it is likely to point to new methods to thwart the spread of computer viruses. Studying the analogy between mathematical models such as dynamic-state models and virus propagation is a central theme of this proposal. The PIs propose three major thrusts in this work. 1) Determine the topology underlying modern viruses and worms. It has been suggested that virus propagation obeys a power-law structure much like the physical Internet topology. However, there is no reason to believe that viral propagations would mirror the physical topology of the network. Rather, evidence suggests that they follow some sort of a social network, or a random network in the case of some worms. Our work will be the first to develop a definitive model of virus propagation topology using real attack data and user data.2) Develop a new model that captures propagation behavior on the virtual topology. Specifically, the PIs are interested in modeling a) topology-aware propagation behavior, b) the effect of environmental factors, and c) the dynamics between infections (dissipation) and defenses (feedback force).3) Use the mathematical models to develop and reason about network-centric defense strategies.The PI team is part of the Center for Computer and Communications Security (C3S) at CMU. One of the center's goals is to promote security education. We are in the process of engineering a new degree program-Master in Information Security. We expect this collaborative research effort to stimulate student interests and foster further research in information security. Symantec will be an industry partner throughout this effort. Specifically, they will supply us with their proprietary database containing an extensive dataset with respect to virus incidents. In addition, two of the PIs hold joint appointments with CERT (part of the Software Engineering Institute, an FFRDC operated by CMU) and have access to a large and growing body of data associated with real virus episodes.