Stochastic behavior of random constant scanning worms

Kurt R. Rohloff; Tamer Başar

doi:10.1109/ICCCN.2005.1523881

Stochastic behavior of random constant scanning worms

Kurt R. Rohloff, Tamer Başar

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

41 Scopus citations

Abstract

This paper discusses modeling and simulation issues associated with the stochastic behavior of a special type of a computer worm called a Random Constant Scanning (RCS) worm. Although these worms propagate by randomly scanning network addresses to find hosts that are susceptible to infection, traditional RCS worm models are fundamentally deterministic. A density-dependent Markov jump process model for RCS worms is presented and analyzed. Conditions are shown for when worm models can safely ignore some stochastic properties of RCS worm propagation. A computationally simple hybrid deterministic/stochastic model for the observed scanning behavior on a local network due to the global propagation of an RCS scanning worm is also presented and discussed.

Original language	English (US)
Title of host publication	Proceedings - 14th International Conference on Computer Communications and Networks, ICCCN 2005
Pages	339-344
Number of pages	6
DOIs	https://doi.org/10.1109/ICCCN.2005.1523881
State	Published - 2005
Externally published	Yes
Event	14th International Conference on Computer Communications and Networks, ICCCN 2005 - San Diego, CA, United States Duration: Oct 17 2005 → Oct 19 2005

Publication series

Name	Proceedings - International Conference on Computer Communications and Networks, ICCCN
Volume	2005
ISSN (Print)	1095-2055

Other

Other	14th International Conference on Computer Communications and Networks, ICCCN 2005
Country/Territory	United States
City	San Diego, CA
Period	10/17/05 → 10/19/05

All Science Journal Classification (ASJC) codes

General Computer Science

Access to Document

10.1109/ICCCN.2005.1523881

Cite this

@inproceedings{dec9ba2322eb42b4b1dbe24482a2e455,

title = "Stochastic behavior of random constant scanning worms",

abstract = "This paper discusses modeling and simulation issues associated with the stochastic behavior of a special type of a computer worm called a Random Constant Scanning (RCS) worm. Although these worms propagate by randomly scanning network addresses to find hosts that are susceptible to infection, traditional RCS worm models are fundamentally deterministic. A density-dependent Markov jump process model for RCS worms is presented and analyzed. Conditions are shown for when worm models can safely ignore some stochastic properties of RCS worm propagation. A computationally simple hybrid deterministic/stochastic model for the observed scanning behavior on a local network due to the global propagation of an RCS scanning worm is also presented and discussed.",

author = "Rohloff, {Kurt R.} and Tamer Ba{\c s}ar",

year = "2005",

doi = "10.1109/ICCCN.2005.1523881",

language = "English (US)",

isbn = "0780394283",

series = "Proceedings - International Conference on Computer Communications and Networks, ICCCN",

pages = "339--344",

booktitle = "Proceedings - 14th International Conference on Computer Communications and Networks, ICCCN 2005",

note = "14th International Conference on Computer Communications and Networks, ICCCN 2005 ; Conference date: 17-10-2005 Through 19-10-2005",

}

Rohloff, KR & Başar, T 2005, Stochastic behavior of random constant scanning worms. in Proceedings - 14th International Conference on Computer Communications and Networks, ICCCN 2005., 1523881, Proceedings - International Conference on Computer Communications and Networks, ICCCN, vol. 2005, pp. 339-344, 14th International Conference on Computer Communications and Networks, ICCCN 2005, San Diego, CA, United States, 10/17/05. https://doi.org/10.1109/ICCCN.2005.1523881

Stochastic behavior of random constant scanning worms. / Rohloff, Kurt R.; Başar, Tamer.
Proceedings - 14th International Conference on Computer Communications and Networks, ICCCN 2005. 2005. p. 339-344 1523881 (Proceedings - International Conference on Computer Communications and Networks, ICCCN; Vol. 2005).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Stochastic behavior of random constant scanning worms

AU - Rohloff, Kurt R.

AU - Başar, Tamer

PY - 2005

Y1 - 2005

N2 - This paper discusses modeling and simulation issues associated with the stochastic behavior of a special type of a computer worm called a Random Constant Scanning (RCS) worm. Although these worms propagate by randomly scanning network addresses to find hosts that are susceptible to infection, traditional RCS worm models are fundamentally deterministic. A density-dependent Markov jump process model for RCS worms is presented and analyzed. Conditions are shown for when worm models can safely ignore some stochastic properties of RCS worm propagation. A computationally simple hybrid deterministic/stochastic model for the observed scanning behavior on a local network due to the global propagation of an RCS scanning worm is also presented and discussed.

AB - This paper discusses modeling and simulation issues associated with the stochastic behavior of a special type of a computer worm called a Random Constant Scanning (RCS) worm. Although these worms propagate by randomly scanning network addresses to find hosts that are susceptible to infection, traditional RCS worm models are fundamentally deterministic. A density-dependent Markov jump process model for RCS worms is presented and analyzed. Conditions are shown for when worm models can safely ignore some stochastic properties of RCS worm propagation. A computationally simple hybrid deterministic/stochastic model for the observed scanning behavior on a local network due to the global propagation of an RCS scanning worm is also presented and discussed.

UR - http://www.scopus.com/inward/record.url?scp=33748372756&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=33748372756&partnerID=8YFLogxK

U2 - 10.1109/ICCCN.2005.1523881

DO - 10.1109/ICCCN.2005.1523881

M3 - Conference contribution

AN - SCOPUS:33748372756

SN - 0780394283

SN - 9780780394285

T3 - Proceedings - International Conference on Computer Communications and Networks, ICCCN

SP - 339

EP - 344

BT - Proceedings - 14th International Conference on Computer Communications and Networks, ICCCN 2005

T2 - 14th International Conference on Computer Communications and Networks, ICCCN 2005

Y2 - 17 October 2005 through 19 October 2005

ER -

Stochastic behavior of random constant scanning worms

Abstract

Publication series

Other

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this