• Proceedings of the Korean Society of Precision Engineering Conference
• /
• 2009.06a
• /
• pp.731-732
• /
• 2009

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.37 no.3B
• /
• pp.212-218
• /
• 2012

An Internet worm is a self-replicating malware program which uses a computer network. As the network connectivity among computers increases, Internet worms have become widespread and are still big threats. There are many approaches to model the propagation of Internet worms such as Code Red, Nimda, and Slammer to get the insight of their behaviors and to devise possible defense methods to suppress worms' propagation activities. The influence of the network characteristics on the worm propagation has usually been modeled by medical epidemic model, named SI model, due to its simplicity and the similarity of propagation patterns. So far, SI model is still dominant and new variations of the SI model, called SI-style models, are being proposed for the modeling of new Internet worms. In this paper, we elaborate the problems of SI-style models and then propose a new accurate stochastic model using an occupancy problem.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.5B
• /
• pp.277-285
• /
• 2007

In this paper, we present a simulation model of Slammer worm propagation process which caused serious disruptions on Internet in the you of 2003 and analyze the process of Slammer by using NS-2. Recently introduced NS-2 modeling called "Detailed Network-Abstract Network Model" had enabled packet level analysis. However, it had deficiency of accommodating only small sized network. By extending the NS-2 DN-AN model to AN-AN model (Abstract Network-Abstract Network model), it is effectively simulated that the whole process from the initial infection to the total network congestion on hourly basis not only for the Korean network but also for the rest of the world networks. Furthermore, the progress of the propagation from Korean network to the other country was also simulated through the AN-AN model. 8,848 hosts in Korean network were infected in 290 second and 66,152 overseas hosts were infected in 308 second. Moreover, the scanning traffics of the worm at the Korean international gateway saturated the total bandwidth in 154 seconds for the inbound traffic and in 135 seconds for the outbound one.

• Journal of KIISE:Computing Practices and Letters
• /
• v.12 no.6
• /
• pp.339-348
• /
• 2006

Recently, many researches on detecting and responding worms due to the fatal infrastructural damages explosively damaged by automated attack tools, particularly worms. Network service vulnerability exploiting worms have high propagation velocity, exhaust network bandwidth and even disrupt the Internet. Previous worm researches focused on signature-based approaches however these days, approaches based on behavioral features of worms are more highlighted because of their low false positive rate and the attainability of early detection. In this paper, we propose a Distributed Worm Detection Model based on packet marking. The proposed model detects Worm Cycle and Infection Chain among which the behavior features of worms. Moreover, it supports high scalability and feasibility because of its distributed reacting mechanism and low processing overhead. We virtually implement worm propagation environment and evaluate the effectiveness of detecting and responding worm propagation.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.12 no.1
• /
• pp.81-86
• /
• 2008

Fast spreading Internet worms, such as Code Red and Slammer, have become one of the new major throne of the Internet recently. In order to defend against theses worms, it is essential to understand how Internet worms propagate and how different Internet factors affect worm spreading. In this paper, we intend to describe the spread of worms on Internet environments accurately. Therefore we model and analyze the spreading effects by various simulations considering Internet addressing and speed. The results lead to a better prediction of the worm spreading on current and future Internet environments.

• Proceedings of the Korea Information Assurance Society Conference
• /
• 2004.05a
• /
• pp.181-185
• /
• 2004

In these days, many reports noticed that the Internet worms spread out and have done considerable damage to all over the world network within a few days. The worms, which is infected from various route such as e-mail, can spread very fast with common property, self replication. But, there is not prepare for the way effectively to interrupt internet worm. Therefore, to prevent our network resource, internet hosts and user clients, the systemic categorization and automatic defense mechanism is required in the Internet worm research. Hence, in this paper, we describe internet worm propagation and defense model.

• Journal of Korea Multimedia Society
• /
• v.9 no.3
• /
• pp.333-341
• /
• 2006

Recently, Random Constant worm is increasing The worm retards the availability of the overall network by exhausting resources such as CPU resource and network bandwidth, and damages to an uninfected system as well as an infected system. This paper analyzes the Power-Law network which possesses the preferential characteristics to restrain the worm from spreading. Moreover, this paper suggests the model which dynamically controls the spread of the worm using information about depth distribution of the delivery node which can be seen commonly in such network. It has also verified that the load for each node was minimized at the optimal depth to effectively restrain the spread of the worm by a simulation.

• Journal of the Korean Society for Precision Engineering
• /
• v.28 no.1
• /
• pp.11-18
• /
• 2011

A worm screw is widely used in a geared motor unit for motion conversion from rotation to linear. For mass production of a high quality worm, the current rolling process is substituted with the milling process. Since the milling process enables the integration of all operations of worm manufacturing on a CNC(Computer Numerical Control) lathe, productivity can be remarkably improved. In this study, the tooling system for side milling on a CNC lathe to improve machinability is developed. However, the cutting tool-workpiece interference is important factors to be considered for producing high quality worms. For adaptability of various worms machining, the tool-workpiece interference simulation system based on a tool-tip trajectory model is developed. The developed simulation system is verified through several kinds of worms and experimental results.

• Journal of the Korean Society for Precision Engineering
• /
• v.26 no.12
• /
• pp.47-54
• /
• 2009

A worm screw is widely used in a geared motor unit for motion conversion from rotation to linear. For mass production of a high quality worm, the current rolling process is substituted with the milling process. Since the milling process enables the integration of all operations of worm manufacturing on a CNC(Computer Numerical Control) lathe, productivity can be remarkably improved. In this study, the tooling system for planetary milling on a CNC lathe to improve machinability is developed. However, the cutting tool-workpiece interference is important factors to be considered for producing high quality worms. For adaptability of various worms machining, the tool-workpiece interference simulation system based on a tool-tip trajectory model is developed. The developed simulation system is verified through several kinds of worms and experimental results.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.47 no.5
• /
• pp.67-74
• /
• 2010

Recently, the early detection and prevention of worm research is mainly studying based on the analysis of generalized worm propagation property. However, it is not easy to do Worm early detection with its attributes because the modeling method for Worm propagation is vague and not specified yet. Worm scanning method is exceedingly effect to Worm propagation process. This paper describes a modeling method and its simulations to estimate various worm growth patterns and their corresponding propagation algorithms. It also tests and varies the impact of various improvements, starting from a trivial simulation of worm propagation and the underlying network infrastructure. It attempts to determine the theoretical maximum propagation speed of worms and how it can be achieved. Moreover, we present the feasibility of the proposed model based on real testbed for verification.