Simulation and Detection of Self-Propagating Worms and Viruses

Large-scale attacks generated by fast spreading
worms and viruses have emerged as a major threat to
the Internet. These worms are capable of infecting
and crippling substantial portions of the Internet
as well as the enterprise networks of large public
and private agencies in a very short time. This
dissertation work studies the behavior of such
viruses and examines the problem of their detection
and containment. It develops a simulation testbed to
study the propagation and threat potentials of self-
propagating viruses. Using the testbed, a new
approach is developed for detecting self-propagating
worms/viruses based on statistical anomaly
detection. The approach assumes that a key
characteristic of a worm/virus attack is an increase
in application based network traffic, which will
eventually overwhelm servers and clients. The
effectiveness of the detection approach has been
tested for email based viruses in an intranet
setting. The report concludes with results of
experiments using a novel approach for cleaning up
virus infections, based on the model of predators
in an ecosystem.

Autorentext
Ajay Gupta obtained his PhD from the Department of Computer Science, State University of Nework at Stony Brook. His research interests include systems and network security, cluster systems and parallel computing. Currently, he is also consulting with School of Business, developing simulation models for business- learning software packages.

Klappentext
Large-scale attacks generated by fast spreading worms and viruses have emerged as a major threat to the Internet. These worms are capable of infecting and crippling substantial portions of the Internet as well as the enterprise networks of large public and private agencies in a very short time. This dissertation work studies the behavior of such viruses and examines the problem of their detection and containment. It develops a simulation testbed to study the propagation and threat potentials of self- propagating viruses. Using the testbed, a new approach is developed for detecting self-propagating worms/viruses based on statistical anomaly detection. The approach assumes that a key characteristic of a worm/virus attack is an increase in application based network traffic, which will eventually overwhelm servers and clients. The effectiveness of the detection approach has been tested for email based viruses in an intranet setting. The report concludes with results of experiments using a novel approach for cleaning up virus infections, based on the model of "predators" in an ecosystem.