• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.35 no.3B
• /
• pp.551-557
• /
• 2010

Fast spreading Internet worms will be sure to become one of the new major threats of convergence networks as well as the Internet. In order to defend and respond them, it is necessary to study how Internet worms propagate and what factors affect worm spreading. In this paper, we try to describe the correct spread of worms on convergence network environments. Therefore we propose a spreading model and analyze the spreading effects by various experiments.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.3
• /
• pp.165-172
• /
• 2006

There are various threats as side effects against the growth of information technology, and malicious codes such as Internet worms may bring about confusions to upset a national backbone network. In this paper, we examine the existed spreading models and propose a new worm spreading model on Internet environment. We also predict and analyze the spreading effects of high-speed Internet worms. The proposed model leads to a better prediction of the worm spreading since various factors are considered.

• Convergence Security Journal
• /
• v.6 no.4
• /
• pp.75-82
• /
• 2006

Internet worm gives various while we paralyze the network and flow the information out damages. In this paper, I suggest the method to prevent this. This method detect internet worm in PC first. and present the method to do an automatic confrontation. This method detect a traffic foundation network scanning of internet worm which is the feature and accomplish the confrontation. This method stop the process to be infected at the internet worm and prevent that traffic is flowed out to the outside. and This method isolate the execution file to be infected at the internet worm and move at a specific location for organizing at the postmortem so that we could accomplish the investigation about internet worm. Such method is useful to the radiation detection indication and computation of unknown internet worm. therefore, Stable network operation is possible through this method.

• The Journal of the Korea Contents Association
• /
• v.6 no.12
• /
• pp.155-162
• /
• 2006

It was well known that how much seriously the Internet worm such as the Code Red had an effect on our daily activities. Recently the rapid growth of the Internet speed will produce more swift damage us in a short term period. In order to defend against future worm, we need to understand the propagation pattern during the lifetime of worms. In this paper, we analyze the propagation pattern of the Code Red worm by a computer simulation. In particular, we show that an existing simulation result about the number of infectious hosts does not match the observed data, and then we introduce a factor of revised human countermeasures into the simulation. We also show the simulation results presenting the importance of patching and pre-patching of the Internet worm.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.11a
• /
• pp.10-12
• /
• 2005

인터넷 및 네트워크가 급격하게 발전함에 따라 많은 피해가 발생하고 있으며, 이러한 피해중 웜은 많은 장비 및 네트워크 상의 위협을 준다 이러한 위협이 되는 웜을 잘 대처하기 위해서는 웜의 행동자체에 대한 파악을 반드시 해야 하고 이에 선행 연구작업으로써 웜 분류는 반드시 실시되어야 한다. 외국의 웜 분류 연구중 UC Berkeley와 시만텍사의 분류방안을 살펴보고 그러한 분류 방안에 기반한 트래픽 및 웜 행동 패턴을 기준으로 전파특성과 웜의 행동 단계별 기준하에 재정립 및 분류 기법을 제안하겠다. 이러한 웜의 분류는 차후 시뮬레이터 모듈의 구현과 칵 모듈의 조합을 통한 구체적인 웜 모델링에 대한 연구의 기초가 된다.

• The KIPS Transactions:PartC
• /
• v.12C no.2 s.98
• /
• pp.191-200
• /
• 2005

The brilliant achievements in computers and the internet technology make it easy for users to get useful information. But at the same time, the damages caused by intrusions and denial of service attacks are getting more worse. Specially because denial of service attacks by internet worm incapacitate computers and networks, we should draw up a disposal plan against it. So far many rule-based intrusion detection systems have been developed, but these have the limits of these ability to detect new internet worms. In this paper, we propose a system to detect intrusion and generate detection rule against scan-based internet worm, paying attention to the fact that internet worms scan network to infect hosts. The system detects internet worms using detection rule. And if it detects traffic causing by a new scan-based internet worm, it generates new detection nile using traffic information that is gathered. Therefore it can response to new internet worms early. Because the system gathers packet payload, when it is being necessary only, it can reduce system's overhead and disk space that is required.

• Journal of KIISE:Information Networking
• /
• v.34 no.3
• /
• pp.186-192
• /
• 2007

The virus throttling technique[5,6] is the one of well-known worm early technique. Virus throttling reduce the worm propagration by delaying connection packets artificially. However the worm detection time is not sufficiently fast as expected when the worm generated worm packets at a low rate. This is because the virus throttling technique use only delay queue length. In this paper we use the trend of weighted average delay queue length (TW AQL). By using TW AQL, the worm detection time is not only shorten at a low rate Internet worm, but also the false alarm does not largely increase. By experiment, we also proved our proposed algorithm had better performance.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.1
• /
• pp.89-102
• /
• 2008

Internet becomes more and more popular, and most companies and institutes use web services for e-business and many other purposes. With the explosion of Internet, the attack of internet worm has grown. Simulation is one of the most widely used method to study internet worms. But, it is quite challenging to simulate very large-scale worm attacks because of various reasons. By this reason, we often use the modeling network simulation technique. But, it also has problem that it difficult to apply each worm attacks to simulation. In this paper, we propose worm attack representation and mapping methods for apply worm attack to simulation. The proposed method assist to achieve the simulation efficiency. And we can express each worm attacks more detail. Consequently, the simulation of worm attacks has the time-efficiency and the minuteness.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.37 no.3B
• /
• pp.212-218
• /
• 2012

An Internet worm is a self-replicating malware program which uses a computer network. As the network connectivity among computers increases, Internet worms have become widespread and are still big threats. There are many approaches to model the propagation of Internet worms such as Code Red, Nimda, and Slammer to get the insight of their behaviors and to devise possible defense methods to suppress worms' propagation activities. The influence of the network characteristics on the worm propagation has usually been modeled by medical epidemic model, named SI model, due to its simplicity and the similarity of propagation patterns. So far, SI model is still dominant and new variations of the SI model, called SI-style models, are being proposed for the modeling of new Internet worms. In this paper, we elaborate the problems of SI-style models and then propose a new accurate stochastic model using an occupancy problem.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.11a
• /
• pp.82-84
• /
• 2005

기존의 웜 탐지는 중요한 네트워크 소스의 폭주라 스위치 라우터 및 말단 시스템에서의 변동 효과를 가지고 공격을 판단했었다. 하지만 최근의 인터넷 웜은 발생 초기에 대응하지 못하면 그 피해의 규모가 기하급수적으로 늘어난다. 또한 방어하기가 어려운 서비스 거부 공격을 일으킬 수 있는 간접 공격의 주범이 될 수 있다는 정에서 웜의 탐지와 방어는 인터넷 보안에 있어서 매우 중요한 사안이 되었다. 본 논문에서는 이미 알려진 공격뿐 아니라 새로운 웜의 스캐닝 공격을 탐지하기 위하여, 패턴 분류 문제에 있어서 우수한 성능을 보이는 Support Vector Machine(SVM)[1]을 사용하여 인터넷 웜의 스캐닝 공격을 탐지하는 시스템 모델을 제안한다.