Modeling and defending passive worms over unstructured peer-to-peer networks?

Abstract

Passive worms can passively propagate through embedding themselves into some sharing files, which can result in significant damage to unstructured P2P networks. To study the passive worm behaviors, this paper firstly analyzes and obtains the average delay for all peers in the whole transmitting process due to the limitation of network throughput, and then proposes a mathematical model for the propagation of passive worms over the unstructured P2P networks. The model mainly takes the effect of the network throughput into account, and applies a new healthy files dissemination-based defense strategy according to the file popularity which follows the Zipf distribution. The simulation results show that the propagation of passive worms is mainly governed by the number of hops, initially infected files and uninfected files. The larger the number of hops, the more rapidly the passive worms propagate. If the number of the initially infected files is increased by the attackers, the propagation speed of passive worms increases obviously. A larger size of the uninfected file results in a better attack performance. However, the number of files generated by passive worms is not an important factor governing the propagation of passive worms. The effectiveness of healthy files dissemination strategy is verified. This model can provide a guideline in the control of unstructured P2P networks as well as passive worm defense.

Keywords

network security / unstructured peer-to-peer networks / passive worms / propagation model / patch dissemination strategy

References

[1] Nassima K., Yannick C., Nazim A.. The emerging threat of peer-to-peer worms [C] IEEE / IST Workshop on Monitoring, Attack Detection and Mitigation, 2006, Tuebingen, Germany: IEEE Press 18-20.

[2] Yu W., Corey B., Sriram C., et al. Peer-to-peer system-based active worm attacks: Modeling and analysis [C] Proceedings of IEEE International Conference on Communications, 2005, Seoul, Korea: IEEE Press 295-299.

[3] Zesheng C., Lixin G., Kwiat K.. Modeling the spread of active worms[C] Proceedings of the Twenty-Second Annual Joint Conference of the IEEE Computer and Communications Societies, 2003, Francisco, USA: IEEE Press 1890-1900.

[4] Zhou L., Zhang L., Mcsherry F., et al. A first look at peerto-peer worms: Threats and defenses [C] Proceedings of the 4th International Workshop on Peer-to-Peer Systems, 2005, Ithaca, NY: ACM Press 24-35.

[5] Guanling C., Robert S. G.. Simulating non-scanning worms on peer-to-peer networks [C] Proceedings of the 1st International Conference on Scalable Information Systems, 2006, Hong Kong, China: ACM Press 29-42.

[6] Thommes R., Coates M.. Epidemiological modeling of peer-to-peer viruses and pollution[C] The 25th Annual IEEE Conference on Computer Communications, 2006, Barcelona, Spain: IEEE Press 15-26.

[7] Krishna R., Biplab S.. Modeling malware propagation in Gnutella type peer-to-peer networks [C] Proceedings of the Third International Workshop on Hot Topics in Peerto-Peer Systems (Hot-P2P), 2006, Rhodes Island, Greece: ACM Press 8-15.

[8] Richard W. T., Mark J. C.. Modeling virus propagation in peer-to-peer networks [C] IEEE International Conference on Information, Communications & Signal Processing, 2005, Bangkok, Thailand: IEEE Press 981-985.

[9] Shakkottai S., Srikant R.. Peer to peer networks for defense against Internet worms [C] Proceedings from the 2006 Workshop on Interdisciplinary Systems Approach in Performance Evaluation and Design of Computer & Communications Systems (INTERPERF’06), 2006, Pisa, Italy: ACM Press 34-44.

[10] Andrew K., Abhinav A., Minaxi G.. A study of malware in peer-to-peer networks [C] Proceedings of the 6th ACM SIGCOMM on Internet Measurement, 2006, Janeriro, Brazil: ACM Press 327-332.

[11] Jacky C, Kevin L, Brian N L. Availability and popularity measurements of peer-to-peer file systems [EB/OL]. http://signl.cs.umass.edu/pubs/, 2007-05-16.

[12] Stefan S., Krishna P. G., Steven D. G.. A measurement study of peer-to-peer files sharing systems [C] Proceedings of Multimedia Computing and Networking 2002 (MMCN’02), 2002, San Jose, CA: ACM Press 361-382.

[13] Krishna P. G., Richard J. D., Stefan S., et al. Measurement, modeling, and analysis of a peer-to-peer file-sharing workload [C] Proceedings of the 19th ACM Symposium on Operating System Principles (SOSP 2003), 2003, ACM Press: Bolton Landing, NY 314-329.

[14] Matthew M. W.. Throttling viruses: Restricting propagation to defeat malicious mobile code [C] Proceedings of the 18th Annual Computer Security Applications Conference (ACSAC), 2002, Nevada, USA: IEEE Press 61-68.

[15] Newman M. E. J., Strogatz S. H., Watts D. J.. Random graphs with arbitrary degree distribution and their applications[J]. Physical Review E, 2001, 64(2): 1-18.

[16] Stutzbach D., Rejaie R., Sen S.. Characterizing unstructured overlay topologies in modern P2P file-sharing systems [C] Proceedings of the Fifth ACM Internet Measurement Conference, 2005, Berkeley, CA: ACM Press 49-62.

[17] Holme P., Kim B. J.. Growing scale-free networks with tunable clustering[J]. Physical Review E (Statistical Nonlinear, and Soft Matter Physics), 2002, 65(2): 1-4.

[18] Barabasi A. L., Albert R.. Emergence of scaling in random networks[J]. Science, 1999, 286(5439): 509-512.